The npm package 'blots' versions 2.1.0 and 2.1.1 contains malicious code that executes preinstall and postinstall scripts. These scripts unconditionally send the installer's username, hostname, current working directory, and timestamp to an attacker-controlled third-party endpoint at webhook.site. The package provides no legitimate functionality and solely performs reconnaissance on the installer's environment during installation.