The npm package test890-auth version 1.0.0 contains malicious code that executes during installation. It collects sensitive environment information and the full contents of the consuming project's package.json file, then sends this data to a hardcoded external server. The package does not provide any legitimate functionality and is designed as a dependency-confusion probe. Systems with this package installed should be considered fully compromised.