The npm package @wbnr/frontend-shared versions 99.0.0 and 99.0.1 contains malicious code in its preinstall lifecycle script. This script collects the installer's OS username and hostname, then sends this information to a third-party callback domain via DNS lookup and HTTPS GET requests. This behavior aligns with a dependency-confusion probe, potentially exposing sensitive environment identifiers to an external attacker-controlled domain.