The npm package @omniwatch-wick/cli version 0.1.2 contains malicious code that collects host system identifiers and user information, then exfiltrates this data to attacker-controlled endpoints. This behavior is not part of any documented CLI functionality and represents an installer-side reconnaissance and data exfiltration beacon. Installation of this package can lead to full system compromise, requiring immediate secret and key rotation from a different machine. Removal of the package alone may not eliminate all malicious software introduced.