Dependency-confusion attack, escalated variant of 99.0.0, same webhook https://test.v3n.my/pwn. preinstall+install+postinstall all run 'node index.js'. Adds require('fs'), safeExec(cmd,{shell:true,timeout:10000}), an UNCONDITIONAL top-level post({type:'exfil'}) at module load before the try block, and a second post({type:'recon', whoami, files:fs.readdirSync(cwd)}). Exfiltrates system data plus env vars matching /KEY|SECRET|TOKEN|PASS|AUTH|CRED|PRIVATE|AWS_|AZURE_|GCP_|GITHUB|NPM|DB_|DATABASE|API/i. Blocked at package level (both of the package's only 2 versions malicious, 0 downloads). Verified statically from the Defender diff (version1=99.0.0); package already 404 on npm.