The helper-agent npm package contains malicious code that executes a postinstall script on every npm install. This script sends installation status data to a hardcoded external webhook and scans specific localhost ports for a particular JSON API. If a matching record is found, it modifies the local service's manifest with an author-chosen status string. The outbound beacon and local mutation occur unconditionally, confirming installation to a third party and potentially altering local services.