The npm package @securihackbot/depconf-flow-1792484611 version 1.2.1 contains malicious code that executes automatically upon installation. Its postinstall script collects host metadata including hostname, user environment variables, platform, architecture, Node.js version, package name, and a nonce. This data is base64-encoded and exfiltrated via an unencrypted HTTP GET request to a hardcoded IP address. A DNS-based fallback exfiltration method is also implemented. This behavior occurs without user consent and affects any build host that resolves this public package instead of an intended internal package.