discovered 2026-07-01
postinstall.js payload SHA256 in @emcd-vue/loans@7.2.0 (Wave 3 scope, republished/live as of 2026-07-02).