The published tarball ships npmjs.npmrc containing a live npm_-prefixed authToken for registry.npmjs.org scoped to @arbocollab. package.json declares "files": ["*"] and .npmignore does not exclude npmjs.npmrc, so every installer receives the credential. The package.json publish:lib script references this same file via --userconfig=npmjs.npmrc, confirming it is the maintainer's real publish credential rather than a stub. Any installer or anyone who downloads the tarball can use this token to publish arbitrary malicious versions under the @arbocollab scope, pivoting into a supply-chain attack against all downstream consumers of any package in that scope. No install-time hooks are present; the harm is the credential redistribution itself. Remediation: revoke the token immediately, unpublish/deprecate affected versions, remove npmjs.npmrc from the published tarball, and add it to .npmignore/files allowlist.