The npm package 'webrix-docs' version 20.2.11 contains malicious code that executes automatically during installation. It runs a script that collects host system information such as hostname, user details, platform, current directory, and command outputs, then sends this data to a remote server. The package appears to be a typosquatting attempt mimicking a legitimate library, with no legitimate code and an empty author field.