The npm package bigbob22-test@1.0.0 contains malicious code in its preinstall script that collects and sends the machine's hostname, OS username, and local time to a Discord webhook. The package itself has no functional code and an empty README. The same malicious script was used by the npm account cutekitten05 in multiple other packages published on the same date.