The npm package fkext-browser-min version 1.0.14 contains malicious code executed during installation. It runs a script that collects the machine's public IP, hostname, and GitHub Actions/CI environment variables, then sends this data to an attacker-controlled webhook URL. It also performs a DNS lookup to an attacker-controlled domain to exfiltrate data via an out-of-band channel. The package has no legitimate functionality and is designed solely for reconnaissance and data exfiltration during installation.