The npm package wos-library-ui@99.0.0 contains malicious code that executes automatically during installation. It collects host and user information from the system and sends it to an external domain via DNS and HTTP requests. This package is a dependency confusion attack targeting an internal package name, causing unintentional data exfiltration during install. Installation of this package may lead to full system compromise.