The npm package mw-test-utils (versions 1.0.0, 10.0.0, and 10.0.1) contains malicious preinstall and postinstall scripts that send the installing user's environment username, hostname, and working directory via unencrypted HTTP requests to a hardcoded IP address. The package contains no functional code and is labeled as a dependency-confusion proof of concept, but the scripts execute automatically on every install, potentially leaking sensitive environment information.