The @nextco/utils npm package version 5.0.0 contains malicious code that executes upon module load. It collects host reconnaissance data including hostname, username, directory paths, OS/architecture, Node.js version, and environment variable names. This data is base64-encoded and sent via an unencrypted HTTP POST request to a hardcoded attacker-controlled server (attacker.cl). The package does not provide an opt-out for this telemetry, exposing sensitive host information to attackers.