The npm package 'gunpowder-ghost' and three related pirate-themed packages contain malicious lifecycle scripts that execute during installation. These scripts search the filesystem for HackTheBox CTF flags and, if none are found, collect environment variables and process environment data. The collected data is base64-encoded and exfiltrated via HTTPS to an attacker-controlled ngrok domain. The packages have no legitimate functionality and are designed to steal sensitive information from infected systems.