The npm package @offa/offa-uwk versions 999.0.0 and 999.0.1 contains malicious code that executes during installation. It collects sensitive environment information including hostname, username, current working directory, and all environment variables, which often contain credentials and tokens. This data is then sent to an attacker-controlled webhook. Additionally, a preinstall hook writes a marker file to a fixed path on the system.