The npm package dpdgroup-css version 2.0.1 contains malicious code that executes during installation. It runs a setup script that collects the installer's machine hostname and sends it to an external hardcoded IP address via an HTTP request. This behavior resembles a dependency confusion attack, where a public package mimics an internal package to exfiltrate internal build-host information. The package provides no legitimate functionality.