template-cards 16.1.2

Details

A dependency-confusion package published 2026-11-07 under the unscoped name template-cards with version 16.1.2 to win resolution over a private package of the same name. Its postinstall hook runs 'node beacon.cjs', which sends the package name, the machine's hostname, the current working directory and the install path by HTTP POST over cleartext to the hardcoded endpoint http://13.140.137.222:8787/_ah/dc; the package entry point sends the same request again whenever the package is loaded with require. The same actor and endpoint as MAL-2026-18356. Self-described as an authorized dependency-confusion test. Remove the package and treat the hostnames and paths of affected build machines as disclosed.