The npm package claims-ac1 version 1.0.0 is a malicious package that collects system information during installation without user consent. It uses dependencies fetched from GitHub tarballs that execute a preinstall script to send details such as Node.js version, home directory, working directory, platform, and architecture to a remote collector host. The package has no legitimate functionality and allows the attacker to change the collector host and code at any time without a new npm release. Machines with this package installed should be considered fully compromised.