The npm package 'sn-flow-client' versions 10.10.10, 20.5.1, and 1.0.2 contain malicious code that executes automatically upon installation. This code collects detailed host and user identity information and sends it to an attacker-controlled external domain without user consent. The package lacks legitimate functionality and appears designed for dependency confusion attacks or reconnaissance.