The npm package @car_loans/dealerships-approval version 7.1.5 contains malicious code embedded in a heavily obfuscated postinstall script. Upon installation, the script downloads and executes attacker-controlled code without user interaction, collects host fingerprinting data, and exfiltrates it via HTTP POST and DNS tunneling. The package masquerades as an internal browserslist config and exhibits dependency confusion tactics by using a suspicious scope and non-existent domain URLs. This results in immediate code execution and data exfiltration on any machine that installs this package from the public registry.