Malicious code: obfuscated preinstall dropper. package.json adds preinstall running 3FWCvzduYZg.js, an XOR-obfuscated eval that AES-128-GCM-decrypts an embedded blob, drops it to os.tmpdir()/<random>.js, executes via node/bun (execSync) and deletes it (errors swallowed). Compromised maintainer release of a high-traffic package (8.3M downloads); ~26-32MB staged payload downloaded from release-assets.githubusercontent.com at install. Supply-chain attack, Sept-2025 npm worm wave.