Malicious code in add-two-numbers-x7q9m (npm)

The npm package add-two-numbers-x7q9m was published with malicious intent. Despite advertising itself as a simple utility to add two numbers, the package's preinstall lifecycle script executed unauthorized reconnaissance and credential harvesting on installation.\n\nThe malicious script enumerated the installer's Desktop directory, searched for .txt files, and used regex pattern matching (/npm_[A-Za-z0-9_-]+/) to extract npm authentication tokens. Any tokens found were transmitted as query parameters to the hardcoded endpoint https://lively-bird-15.webhook.cool.\n\nThis behavior ran automatically during npm install, without user awareness or consent. The harvested npm tokens could be used to compromise the victim's npm registry account and enable downstream supply-chain attacks via the victim's publish rights. The random name suffix (x7q9m) is consistent with a disposable malicious-publish account.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.