The npm package '@finxsecdemo/utils' versions 1.0.2 and 1.0.3 contain malicious code that executes during installation. The postinstall.js script performs an HTTPS GET request and DNS resolution to a hardcoded external domain, sending system information such as hostname, user info, and environment variables. This behavior effectively leaks the installer's source IP and DNS resolver IP to an attacker-controlled server. Additionally, the package's main function returns corrupted output that can disrupt consumers displaying formatted currency. This malicious activity occurs regardless of the package's labeling as a 'dependency confusion PoC.'