The npm package ai-explain version 0.3.4 contains malicious code that collects host environment information including OS username, hostname, current working directory, platform, architecture, and Node.js version. This data is sent to a hardcoded external endpoint during installation and each CLI invocation without user disclosure. The package impersonates a legitimate project to lure users. This behavior enables tracking of developer or CI machines by the attacker.