The npm package idlive-face-capture-web-development@78.8.1 contains malicious code that executes a preinstall script making an unauthorized HTTPS request to a third-party server with a hardcoded authorization token. This behavior leaks the installer's IP address, User-Agent, and install timing, confirming successful execution to an attacker-controlled server. The package identity is inconsistent and indicative of a dependency confusion or typosquatting attempt. Installation of this package may lead to full compromise of the host system.