The npm package @uwr/colors version 1.3.6 contains malicious code in its postinstall script that leaks the installer's machine hostname by performing a DNS lookup to a Burp Suite Collaborator subdomain. This behavior occurs without user consent and appears to be a reconnaissance probe possibly related to dependency confusion attacks. The package claims to provide trivial color constants but has an empty author field and suspicious namespace usage.