The npm package 'test22221' versions 2.2.7, 2.2.8, and 2.2.9 contain malicious lifecycle scripts that execute during installation. These scripts send host-identification data to an attacker-controlled IP address over plain HTTP and maintain a persistent long-polling connection to the same endpoint. This behavior is unauthorized and serves no legitimate purpose in the installation process.