The npm package 'verify-cli' version 99.0.0 contains malicious code that executes automatically during installation. It collects sensitive system information and files, including user identity, hostname, and contents of /etc/passwd, /etc/hosts, and /etc/shadow (if readable), then sends this data to a hardcoded external endpoint. The package exhibits characteristics of a typosquatting or dependency confusion attack, with an implausible version number and placeholder metadata.