The quickgreet npm package version 0.0.2 contains malicious code in its postinstall script that exfiltrates the installer's hostname to an attacker-controlled domain. This behavior occurs during npm install and does not perform any legitimate build or install tasks. The exfiltration uses an out-of-band interaction service to confirm code execution and gather environment information.