The npm package '@nuri.yavuz.tr.2/my-unique-pinger' version 1.0.2 contains malicious code that executes a postinstall script. This script sends the installer's operating system username to a third-party logging endpoint unrelated to the package's intended function. The package's main code is a trivial stub, with the lifecycle hook being the primary malicious behavior.