MAL-2026-18374 — Malicious code in dsh-volcengine-provider (npm)

Analysis of dsh-volcengine-provider version 0.2.8 found no evidence of installer-side attack behavior. However, the source states that any computer with the package installed or running should be considered fully compromised.