The curse-allies-module npm package version 1.0.0 contains malicious code that executes a postinstall script sending an HTTPS POST request to a third-party collector URL. This action occurs unconditionally during installation, signaling to an attacker that the package was resolved and executed in the target environment. This behavior is indicative of reconnaissance activity to detect internal build infrastructure resolution, potentially enabling targeted follow-on attacks.