The npm package 'feed-widget-helper' contains malicious code that, upon loading, automatically fetches private profile data from the same origin and exfiltrates it by posting to a state-changing endpoint without user interaction. The package masquerades as a helper library but is actually a same-origin CSRF and data exfiltration payload. The package metadata is empty or placeholder, indicating it is not a legitimate utility. Any system with this package installed should be considered fully compromised, and all stored secrets and keys should be rotated immediately.