The sams-sr-sdk-h5 npm package is a malicious package published to perform dependency confusion attacks by impersonating an internal package namespace. It includes a preinstall script that executes automatically during npm install, collecting host metadata including public IP, hostname, OS username, and runtime environment, then sends this data to an attacker-controlled Sentry project. The package also silently routes application error telemetry and end-user PII to the attacker's Sentry endpoint if used as intended. This behavior constitutes reconnaissance and data exfiltration. The affected version is 7.0.0. There is no official patch or remediation guidance provided.