The npm package 'vybscan-testbed-inert-postinstall' version 1.0.0 contains malicious code in its postinstall script. This script executes automatically during 'npm install' and collects the host's user identity and environment variables, which often include sensitive credentials and tokens. The collected data is then sent to an attacker-controlled remote endpoint without user consent or interaction.