The npm package xapi-lib versions 88.2.3, 88.2.5, 90.2.1, and 90.3.1 contains malicious code that executes a preinstall script during npm install. This script sends an HTTP request with a hardcoded authorization header to an external domain unrelated to the package's stated functionality, potentially exposing the installer's IP and environment. The package itself provides no legitimate library functionality and is considered fully malicious.