The npm package 'strapi-plugin-vinsoc-1109' version 3.6.8 contains malicious code that executes during installation. Its postinstall script silently sends the hostname of the installing machine to an attacker-controlled domain, leaking machine identifiers without performing any legitimate plugin functions.