The npm package easypanel-deploy version 1.0.0 contains malicious code that executes during the preinstall lifecycle script. This code collects host identifiers such as hostname, username, current directory, and CI environment variables, encodes them, and sends them to an attacker-controlled domain without user consent. The package behaves like a dependency-confusion beacon, exfiltrating reconnaissance data to a hardcoded third-party endpoint. Although labeled as a 'benign canary' in the source, the behavior is consistent with malicious activity.