The npm package 'bugexploit' version 99.9.9 contains malicious code that executes a postinstall script. This script runs automatically on installation and collects the installer's username, hostname, and current working directory. It then sends this information unconditionally to a hardcoded external webhook URL unrelated to the package's declared purpose. This behavior constitutes a privacy breach and potential reconnaissance activity by the attacker.