The npm package @goparrot-dashboard/app version 0.0.2 contains malicious code that executes automatically during installation. It collects host identifiers such as hostname, current user, and working directory, then sends this information to an attacker-controlled callback server via DNS and HTTPS requests. This data exfiltration occurs without user interaction, effectively leaking identifying information about the installer's machine.