The npm package cutekitten-test@1.0.1 contains malicious code that executes during installation. Its preinstall script sends the machine's hostname, OS username, and local time to a Discord webhook, potentially leaking sensitive environment information. The package has no functional code beyond this data exfiltration behavior.