The npm package @itsreduxtm/unpkg-xss-test contains malicious code that executes immediately upon import or require. It fetches a list of Linux binary names and performs concurrent HEAD requests to a third-party domain, using the installer's machine and IP address to conduct unauthorized scanning. This behavior covertly weaponizes the installer's identity for reconnaissance against an unrelated site, potentially exposing the installer to abuse reports, IP blocklisting, and legal complaints.