The crosswalker npm package versions 1.0.0, 1.0.1, and 18.2.1 contain malicious code that executes automatically during installation. The preinstall script runs index.js, which collects detailed system and user information and sends it to a hardcoded external URL. This behavior results in unauthorized data exfiltration from the host machine on every install.