The npm package 'fieldbase-webapplication-buildtools' version 99.99.99 contains malicious code that executes automatically during installation. It collects sensitive environment information such as the installer's username, hostname, current working directory, and package name, encodes this data, and sends it to a hardcoded external endpoint via HTTPS and DNS queries. This behavior is consistent with a dependency confusion attack targeting internal package names.