@webapp-shared/login-vmok is a malicious npm package designed for dependency confusion attacks. It impersonates an internal scoped package and was published with multiple versions containing a postinstall script that sends sensitive host information to a remote server over unencrypted HTTP. The package also sends this data whenever it is loaded, disclosing internal hostnames and filesystem paths to an attacker-controlled endpoint. Placeholder versions without malicious code exist but are not affected.