The npm package elsisi-cli version 9.9.9 contains malicious lifecycle scripts that execute during installation. These scripts send outbound HTTP requests to an attacker-controlled webhook, leaking the installer's current working directory and hostname. The package tarball includes only a package.json file with no legitimate source code or functionality, indicating its sole purpose is data exfiltration during installation.