Coordinated dependency-confusion wave on npm: 21 packages published 2026-08-12 under bin names exposed by Google-affiliated scoped packages (@angular/, @bazel/, @google/, @googlemaps/, @tensorflow/*) that had never been registered as standalone names. Each package ships nothing but a package.json postinstall hook and a postinstall.js that POSTs host reconnaissance - hostname, platform, architecture, Node version and the npm lifecycle event - to a per-package attacker subdomain.