The npm package 'afterpay-sdk-example-server' versions 20.0.0 and 1.2.1 contain malicious code that executes a preinstall script during npm install. This script collects sensitive host information including system identifiers, user info, DNS servers, and contents of critical files like /etc/passwd and /etc/hosts, then exfiltrates this data to an attacker-controlled domain. The package impersonates an internal Afterpay SDK example, consistent with a dependency confusion attack targeting internal build systems. Installation of this package can lead to full system compromise.