The npm package 'test899-auth' version 1.0.1 contains malicious code that executes during installation. It collects detailed host and user identity information and exfiltrates it via DNS queries to a malicious domain, bypassing typical HTTP egress filtering. The package also has a self-referential dependency, indicating it may be a proof-of-concept or malicious probe rather than a legitimate authentication library. Installation of this package compromises the host, and removal may not fully restore system integrity.