The @flex-ng/header-component npm package is a malicious package published as part of a dependency confusion campaign. It masquerades as a legitimate internal package but contains a preinstall script that collects and sends sensitive telemetry data, including public IP, hostname, OS username, and runtime environment details, to an attacker-controlled Sentry endpoint without user consent. The package also silently routes any error telemetry from consumers to the attacker. This behavior constitutes unauthorized data exfiltration and potential full system compromise.