The relativity-foundation-core npm package version 6.8.2 contains malicious code in its preinstall script. This script collects system and environment information such as hostname, user name, current working directory, npm registry configuration, and CI environment variables, encodes this data in base64, and sends it via an HTTPS GET request to an attacker-controlled domain on every npm install. The package's main index.js file is empty, indicating its sole purpose is reconnaissance and data exfiltration.