The npm package sc-geeksquad-core@9999.0.0 contains malicious code in its preinstall script that collects environment and system information from the installer and sends it to a hardcoded external IP address. This package uses a placeholder version and a generic name to perform dependency confusion reconnaissance by attempting to detect vulnerable private namespace builds during installation.