discovered
dist/intro.js binary payload container (7.8 MB). Byte-identical across all 5 compromised versions (8.14.0, 8.16.0, 8.17.0, 8.18.0, 8.20.0). Custom binary format (magic \x1bCSI\x01) containing gzip-compressed Rust-compiled infostealers for Linux, Windows, and macOS.