The npm package 'test_adminet' version 99.9.9 contains malicious code that executes automatically during installation. It runs a preinstall script that collects sensitive system information and files, including local user and host identifiers and contents of /etc/passwd, /etc/hosts, and /etc/shadow. The collected data, including password hashes if run with root privileges, is exfiltrated via a crafted HTTP request to a hardcoded external endpoint. This behavior occurs without user interaction during a standard npm install.