The npm package 'akshajrawat.utils' contains malicious code that executes a postinstall script during installation. This script sends an unconditional HTTPS GET request to an external URL, transmitting the installer's HOME path and USERNAME as query parameters. This behavior constitutes a supply-chain exfiltration risk, potentially exposing sensitive environment information. Although the package may be a proof-of-concept or research artifact, the mechanism can be easily redirected to attacker-controlled hosts, posing a critical security risk to any system installing this package.