The npm package datefmt-pro masquerades as a date formatting utility but contains malicious code that executes during installation. Its postinstall script collects system information such as hostname, user identity, kernel details, current directory, and network interfaces, then sends this data unencrypted to a hardcoded external IP address. The package aims to appear legitimate to entice installation while performing reconnaissance on the host system.