discovered
Wave 3 dependency confusion package published by emcd-vue on 2026-06-01T07:05:43Z, 91 seconds after @emcd-vue/auth@6.4.8. Identical infrastructure: same C2 endpoints (oob.moika.tech/payload, oob.moika.tech/report), same X-Secret, same payload filename (~/.emcd-vue_init.js), same User-Agent (emcd-vue-telemetry/1.0). Targets the @emcd-vue scope, impersonating EMCD's internal loan/lending modules.