The npm package 'cma-self-hosted-sandbox-cf' version 1.0.0 contains malicious code that executes automatically during installation. It collects sensitive system information including hostname, user details, home directory, DNS servers, and contents of /etc/passwd and /etc/hosts. This data is exfiltrated via HTTPS POST to an attacker-controlled domain unrelated to the package's legitimate function. This behavior constitutes a dependency confusion and reconnaissance exfiltration attack.