The npm package webrix-docs1 version 10.2.11 contains malicious code that executes a preinstall script during npm install. This script collects detailed system and user information from the host machine and sends it to an attacker-controlled endpoint. The package mimics a legitimate project name, suggesting a typosquatting or dependency confusion attack. There is no advertised functionality or author information, indicating it is solely designed for reconnaissance and data exfiltration.