The npm package @mrbenty8jf1p9y5/oidc-bind-canary version 0.0.3 contains malicious code that executes during installation. Its postinstall script makes an HTTPS request to an attacker-controlled Cloudflare tunnel, spoofing the Host header to appear as legitimate GitHub Dependabot traffic and disabling TLS certificate validation. This behavior indicates an install-time beacon designed to communicate with an attacker-controlled server automatically upon npm install.