The npm package capacitor-plugin-service-worker versions 100.0.0 through 100.2.0 contain malicious code that executes automatically upon installation via a preinstall script. The malicious code collects sensitive system and network information — including hostname, IPv4 addresses with MAC addresses, DNS servers, DNS resolution data, reverse DNS, OS type/release, CPU count, memory usage, and load averages — and exfiltrates it via HTTPS POST to the attacker-controlled OAST domain hwoapraaaotwtsnourpqddszm5n3kkhvo.oast.fun. This constitutes a supply chain attack targeting any developer or CI/CD pipeline that installs the affected package.