The npm package @innocarpe/deepseek-build version 1.0.0 contains malicious code in its postinstall script that executes automatically upon installation. This script uses Node.js child_process to send POST requests containing environment and host identifier data, effectively performing install-time reconnaissance on the host system. This behavior is not part of any documented build process and represents unauthorized data exfiltration during package installation.