The npm package axelarjs-sdk@1.0.1 is a malicious package that contains no functional code but executes a preinstall script during installation. This script sends the machine's hostname, OS username, and local time to a Discord webhook, potentially leaking sensitive environment information to an attacker-controlled endpoint.