The npm package 'test8999-auth' version 1.0.1 contains malicious code that executes automatically upon installation. It collects detailed host system information and user identity data, then exfiltrates this data via an HTTP POST request to a hardcoded external domain associated with malicious activity. The package declares itself as a dependency and uses a naming pattern consistent with dependency confusion attacks. Installation of this package can lead to full system compromise.