Package mimics 'tinycolor2' by 1 char. Postinstall script downloads xmrig binary keyed to repo CI environment variables.
# Reproduction steps redacted under coordinated disclosure. # Full PoC will be published with the advisory at embargo expiry. $ zds reproduce ZDS-2025-0138