discovered
Campaign member. Versions 1.0.7 and 1.1.4-1.1.6 ship a ~277KB obfuscated payload (script/prelude.cjs; 1.0.7 used lib/prelude.js) auto-executed via postinstall 'node ./script/prelude.cjs' (1.0.7: 'node lib/prelude.js'). Latest 1.1.7 scrubbed to empty scripts. Same payload template as the root lineage.