The npm package 'clover-codelab-remote-pay-cloud' version 99.9.9 is a malicious package designed to exfiltrate system information during installation. It runs a postinstall script that collects OS username, current working directory, hostname, and non-internal IPv4 address, then sends this data to a hardcoded external URL. The package mimics the name of a legitimate Clover SDK to exploit dependency confusion but provides no legitimate functionality.