The npm package 'box-sign-client-poc' version 1.0.0 contains malicious code that executes during installation. It runs a script that collects the installer's hostname and OS username, then sends this information via a DNS query to a third-party collector at canarytokens.com. This behavior results in exfiltration of host and user identifiers to an external party at install time.