The npm package wxwxtt (versions up to 99.0.1) contains malicious code that performs host reconnaissance during installation and import. It runs a postinstall script and module code that collect system and process information, including host name, install path, working directory, and OS details, then sends this data to a hard-coded remote collector. The package has no legitimate functionality to justify this behavior and is part of a dependency-confusion campaign alongside the troubleshooting package.