The npm package upload-to-gcp version 3.2.1 contains malicious code that executes a postinstall script during installation. This script collects host system identifiers and environment details, then sends this data to a suspicious external domain unrelated to Google Cloud Platform. This behavior occurs without user consent or disclosure, indicating a privacy and security risk.