The npm package 'foodi' version 99.99.1 contains malicious preinstall and postinstall scripts that execute commands to collect the username, hostname, and environment variables, then exfiltrate this data via an insecure POST request to an external server. The package's main module is empty, indicating its primary purpose is to perform install-time data exfiltration, potentially leaking sensitive credentials and tokens from developer or CI environments.