The npm package com.db.dbk.ui-forms versions 99.0.0 and 99.0.1 contains malicious code that executes automatically during installation. It collects sensitive host information and environment variables potentially containing secrets, then exfiltrates this data to a hardcoded external server. The package is described as a 'dependency confusion proof of concept' but performs unauthorized data exfiltration regardless.