The tme-xca npm package version 3.0.0 is a malicious package published as part of a dependency confusion campaign. It includes a preinstall hook that executes code to collect and send the installer's public IP address and host telemetry, including personally identifiable information, to an attacker-controlled Sentry endpoint. This behavior occurs automatically during npm install, before application code runs. The package impersonates internal package namespaces to trick misconfigured resolvers into installing it instead of legitimate private dependencies. The malicious payload is identical across packages from the same attacker account, differing only in package name and target Sentry project. Installation of this package compromises the host, potentially exposing secrets and keys stored on the system.