The npm package 'editor_application' version 9999.0.0 contains malicious code that executes a preinstall hook running 'node callback.js'. This code collects host identifiers and private CI repository information from environment variables and sends them via an unencrypted HTTP GET request to an attacker-controlled IP address. This behavior is indicative of a dependency confusion attack beacon designed to map internal package namespaces and CI environments of affected organizations.