The npm package @hkyyy/portal-widget-helper-0601 version 1.0.0 contains malicious code that executes a post-installation script performing reconnaissance on the host system. The script runs commands such as whoami, id, hostname, and collects environment details, then attempts to exfiltrate data via network requests, although the exfiltration URL is currently a placeholder. This package appears to be designed for dependency confusion attacks to fingerprint and potentially compromise systems that mistakenly install it. Any system with this package installed should be considered fully compromised.