The npm package 'contracts-upgradeable' is a malicious package impersonating '@openzeppelin/contracts-upgradeable'. It contains no functional code but executes a preinstall script that sends the machine's hostname, OS username, and local time to a Discord webhook, potentially leaking sensitive environment information. The package was published on 2026-11-02 by the npm account 'bigdevin55', which also published another package with the same malicious behavior. Another account 'cutekitten05' used the same webhook in packages published the day before.