The npm package 'notafollower122' contains malicious code in its postinstall script that executes automatically during installation. This script collects AWS ECS container metadata from the installer's environment and exfiltrates it to an anonymous ngrok tunnel. The package lacks any legitimate source code or documented functionality, indicating the postinstall script serves no valid purpose other than reconnaissance and data exfiltration. Multiple versions of the package (1.0.0 through 1.0.7) are affected.