The npm package @uol-afiliados/affiliated-config-lib version 102.0.0 contains malicious code that executes a preinstall hook. This hook runs a shell command that sends the host name and current user name of the installing system to an attacker-controlled domain. The package provides no legitimate functionality and appears to be used for reconnaissance via dependency confusion.