A malicious npm package named 'consumerweb' version 2200.4.2 contains preinstall and postinstall scripts that execute code to collect host environment information and exfiltrate it to an attacker-controlled domain. The package appears to be part of a dependency confusion attack targeting internal package names, leaking sensitive environment details without user consent.