The opencode-skills-collection npm package contains multiple utility scripts that perform network operations such as curl, ping, GET, and POST requests. These scripts do not automatically execute during installation and do not contain hardcoded attacker command and control servers or environment scraping. However, the package is flagged as malicious by GHSA malware sources, indicating that any system with this package installed should be considered fully compromised, and all secrets and keys should be rotated. Removal of the package alone may not eliminate all malicious software.