The npm package @debile/require-dir is a typosquatted republishing of the popular require-dir package. Its package.json includes a preinstall script with a conditional curl command to an attacker-controlled server, currently disabled by an always-false condition. This setup allows an attacker to easily activate an install-time beacon for reconnaissance by modifying the condition. Versions 1.9.1 and 1.9.2 of @debile/require-dir are affected. No known exploits in the wild have been reported.