The npm package vscode-designer-14 version 14.0.1 contains malicious code that executes during installation. It runs a preinstall script that collects sensitive system information including hostname, username, home directory, DNS configuration, and contents of /etc/passwd and /etc/hosts. This data is exfiltrated via HTTPS to a hardcoded external server. The package has no legitimate functionality justifying this behavior and appears to be a typosquatting or dependency confusion attack designed to steal system data.