The ai-analyzer npm package versions 1.0.14 through 1.0.19 contain malicious code that performs unauthorized data exfiltration during installation and runtime. The preinstall script leaks the installer's hostname and environment details to an external domain controlled by an offensive-security actor. Additionally, a postinstall script writes sensitive user and environment information to a temporary local file. The package's analyzeEmail() function sends caller-supplied content to a hardcoded external server without user control or consent, potentially exposing sensitive data.