The mcp-util-helpers npm package version 1.0.0 contains malicious code that executes during installation. Its preinstall script collects extensive host information and environment secrets, then sends this data to a remote webhook. It also supports operator-controlled remote code execution by executing commands or downloaded files based on the webhook response.