The npm package 'dependency_confusions' version 99.9.9 contains malicious code that executes automatically upon installation via a postinstall hook. This code collects sensitive environment information including the installer's OS username, hostname, current working directory, local IPv4 address, and platform, then sends this data to a hardcoded external webhook. This behavior facilitates reconnaissance for dependency confusion attacks by revealing internal build host details and private package namespaces without user consent.