The npm package home-mp-commons version 999.0.1 is a malicious dependency-confusion squat that executes code during installation. Its postinstall.js script sends the installer's OS hostname to an attacker-controlled domain via an HTTPS request. This exfiltration occurs automatically at install time, regardless of any self-proclaimed 'security research' labeling.