The npm package 'conversionvaluemanager' version 3.0.0 contains malicious code that executes during installation. Its postinstall.js script collects host and environment information and sends it via an unencrypted HTTP GET request to an external third-party server. The package is framed as a dependency confusion proof-of-concept but leaks sensitive installer data on every install.