GHSA-pmgv-94f5-6w7w: Malicious Package in eact

The advisory describes malicious behavior (data exfiltration) but provides no source code, commit diffs, or implementation details. While we can infer that functions related to telemetry collection (e.g., gathering system info) and network communication (e.g., sending data to a remote server) must exist, the lack of concrete code evidence prevents specific function identification with high confidence. Typosquatting attacks rely on package name confusion rather than specific function vulnerabilities, making this a supply-chain issue rather than a code-level vulnerability.