The npm package @espn-ping/react-dmed-oauth version 666.0.0 contains malicious code in its preinstall lifecycle script. This script executes automatically during npm install, collects sensitive environment information including hostname, working directory, username, and public IP, and sends this data covertly to a remote server. The malicious behavior is hidden by suppressing output to the installer's console. This appears to be a dependency-confusion attack targeting an internal ESPN/Disney namespace.