The npm package 'csv-parser-helper' version 1.0.0 is a malicious package masquerading as a CSV parser. Instead of providing CSV parsing functionality, it executes a postinstall script during npm install that collects sensitive environment and system information, including hostname, user, process details, and cloud instance metadata. This data is encoded and exfiltrated to a hardcoded external server. No legitimate CSV parsing code is present in the package.