The npm package @offa-uwk/offa-uwk version 999.0.6 contains malicious code that executes during installation. Its postinstall script collects host identifiers and sends them to a hardcoded external URL, then forcibly shuts down the host machine. A preinstall step writes a marker file outside the package directory. This behavior is consistent with a proof-of-concept malicious artifact.