The npm package tracker-radar-detector version 1.0.1 contains malicious code that executes automatically during installation. The malicious script collects sensitive system information including hostname, OS username, home directory, DNS server list, and reads /etc/passwd and /etc/hosts files if present. This data is then sent via HTTPS POST to an attacker-controlled out-of-band callback domain unrelated to the package's intended functionality.