MAL-2026-11205 — Malicious code in the redis-type-xyz npm package

redis-type-xyz is an empty impersonation of Redis OM that presents itself as Redis-related and replaces the legitimate ulid dependency with the malicious ulid-xyz dependency. Installing it pulls in ulid-xyz, whose postinstall hook launches a background agent.