The npm package dc-renewals-layout2 version 9999.0.0 contains malicious code in its preinstall script that executes automatically during installation. This script sends a plaintext HTTP GET request to a hardcoded IP address on a non-standard port, transmitting sensitive environment information such as the installer's hostname, username, current working directory, npm registry, and CI repository slug. This behavior is identified as a dependency-confusion reconnaissance beacon, which can reveal private internal package names and enable targeted attacks against the installer's organization.