The npm package identity-two-factor@999.0.0 is a malicious dependency-confusion package targeting Coinbase. It contains no functional code but executes a postinstall script that collects system metadata and exfiltrates it to a third-party webhook URL. This unsolicited data exfiltration occurs automatically upon installation without user authorization.