The npm package cs-core-api-phoenix version 5.1.0 contains malicious code that executes during installation. Its postinstall script collects the operating system's username and hostname and sends this information to a third-party URL without user consent. This behavior occurs automatically on installation and exposes user identity data to an external actor.