The npm package wiselllx (versions 0.0.1 and 1.0.1) is identified as a malicious dependency-confusion package. It contains a postinstall script and an index.js file that both collect host and process metadata and send this information to a hard-coded remote endpoint. The package has no legitimate functionality and is used as a reconnaissance beacon to profile installer environments for potential follow-on compromise.