The npm package 'fr-ito-web-react' version 99.99.99 contains malicious code that executes during installation. It runs system commands to gather user and system identity information and exfiltrates this data to an attacker-controlled domain. The package uses preinstall and postinstall hooks to execute this behavior without user interaction. The version 99.99.99 is a dependency confusion cover version designed to override internal packages of the same name.