The npm package pp-react-worldready-v5 version 1.0.0 contains malicious code that executes during installation. The package's preinstall script runs a JavaScript file that collects the installer's public IP, hostname, and GitHub Actions environment variables, then exfiltrates this data via HTTPS and DNS queries to attacker-controlled endpoints. The package lacks its declared main file, indicating it has no legitimate functionality and is likely a typosquatting attempt for reconnaissance.