The npm package 'giantswarm' version 22.0.1 contains malicious code that executes a preinstall hook running 'node index.js' during installation. This script collects detailed host information including hostname, platform, architecture, user details, and current working directory, then sends this data to a hardcoded external server. The package impersonates the legitimate Giant Swarm vendor namespace, suggesting a dependency confusion attack. It contains no legitimate functionality and lacks author, description, and license metadata.