The npm package csvflow-schema version 1.0.0 was found to contain malicious code in its postinstall script. This script collects local system information, writes it to a temporary file, launches the Windows calculator application, and sends an HTTPS request to a hardcoded external domain with a unique install identifier. The package was removed from npm shortly after publication.