The npm package frontend-vue-next versions 1.0.0 and 1.2.0 contains malicious code that executes automatically during installation. The package runs a script that collects detailed system and user identity information and sends it to an attacker-controlled server. This behavior leaks sensitive host and user data without consent, posing a privacy and security risk to developers and CI environments.