The npm package 'zystcdemo' masquerades as a date formatting utility but contains a malicious postinstall script. This script executes automatically during installation, collecting system information such as the current user, hostname, platform, and time. It then sends this data to a remote server unrelated to the package's stated functionality. The package version 1.0.0 is affected.