The npm package 'reactjs-risk' versions 99.17.1 and 99.17.2 contains malicious code that executes during installation. Its preinstall script collects host identity metadata including hostname, username, and platform, encodes this data, and sends it via DNS lookup to a third-party domain without user consent. The package's main entry point is a non-functional stub, indicating the sole purpose is to exfiltrate installer information. This behavior is deliberately obfuscated to evade detection.