The npm package @latlongid/location version 1.0.1 contains malicious code that executes automatically upon installation. The postinstall script runs a JavaScript file that encodes the installer's hostname and sends it as part of a DNS query to an external domain, effectively exfiltrating host identification data. This behavior is consistent with reconnaissance activity aimed at identifying internal build environments, potentially for dependency confusion attacks.