The npm package 'analytics-widget' versions 1.0.0 and 1.0.1 contains malicious code that exfiltrates user authentication tokens or the entire browser localStorage to an attacker-controlled endpoint. The package masquerades as an analytics tool but performs no legitimate analytics functions. This behavior enables session hijacking of users in applications that include this package.