The npm package whs4_ued version 1.0.0 contains malicious code that executes during installation. Its postinstall script runs a Node.js script that sends sensitive host information, including the absolute path of the package file (revealing OS username and home directory structure), Node.js version, platform, and architecture, to an attacker-controlled Discord webhook without user consent.