discovered 2026-06-23
Campaign member, masquerades as a logger utility. Version 2.15.5 ships a 282KB obfuscated payload (dist/bootstrap.js) auto-executed via postinstall 'node dist/bootstrap.js'. Same execution wrapper and payload template as the root lineage.
