The npm package mw-communication-client contains malicious preinstall and postinstall scripts that send the installer's OS username, hostname, and current working directory via unencrypted HTTP requests to an attacker-controlled IP address. The package has no functional code and is a dependency-confusion proof of concept targeting private internal package names. It leaks sensitive environment information during installation without executing further code.