The npm package 'dependencykfee-2' versions 1.0.0, 1.0.5, 1.5.5, and 1.8.9 is identified as malicious. It contains no functional code but runs a preinstall script that encodes the installer's current working directory path and exfiltrates it via DNS queries to a domain controlled by attackers. This behavior leaks sensitive environment information such as OS username, host layout, and project name during installation. The package appears to be a reconnaissance probe consistent with dependency confusion attacks.