The npm package mui-wrapper-x-date-pickers versions 1.0.0 and 10.0.0 contains malicious preinstall and postinstall scripts that send the installer's OS username, hostname, and current working directory in plaintext HTTP requests to an untrusted external IP address. The package mimics the naming pattern of a legitimate internal package to exploit dependency confusion. No other code execution or payload is present beyond these data exfiltration requests.