A malicious npm package named 'appsignal' (version 9999.0.0) impersonates the legitimate '@appsignal/*' scope. It uses a preinstall script that sends system and environment details to a hardcoded IP address, likely to identify internal build systems vulnerable to dependency confusion attacks.