The npm package 'add-two-numbers-x7q9m' versions 1.0.0 and 1.0.1 contains malicious code that executes during installation. Its preinstall script enumerates the installer's Desktop directory, extracts npm authentication tokens from .txt files using a regex, and sends these tokens to a hardcoded external endpoint. This behavior is unrelated to the package's advertised functionality and enables attackers to hijack npm registry accounts and propagate supply-chain attacks.