The npm package 'subapp-pkg-util' versions 99.0.0 and 99.0.1 contains malicious code that executes automatically upon installation. It collects detailed host information including OS details, user info, public IP, and geolocation data, then sends this data to a hardcoded external domain associated with malicious activity. The package is identified as a dependency-confusion proof-of-concept but acts as malware by compromising the host system. Removal of the package does not guarantee full remediation due to potential further compromise.