The npm package 'store-locator-widget' version 9999.0.0 is a malicious package that contains no functional code but includes a preinstall script that collects environment information from the installer and sends it to an attacker-controlled IP address. This behavior is consistent with a dependency confusion reconnaissance probe, leaking sensitive build and environment details during installation.