The npm package zeal-rq-hooks version 0.0.0 contains embedded malicious code in canary.js that collects host-identifying information such as hostname, username, platform, Node/npm version, and current working directory. This data is sent via a POST request to a hardcoded external endpoint not affiliated with the npm registry or the package publisher. This behavior constitutes a privacy and security risk due to unauthorized data exfiltration.