The npm packages @zmtcdn/ui versions 9999.0.0 and 9999.0.7 are malicious dependency-confusion packages that execute a postinstall script sending system environment details to an external server without user consent. The postinstall script collects hostname, username, platform, working directory, environment variable names, and a timestamp, then sends this data to https://www.hinny.shop/api. These packages were published by a suspicious npm account and have no legitimate functional purpose for this data transmission.