The npm package 'r17d-sec-research-marker' version 1.0.0 contains malicious code that executes during installation. Its postinstall script collects detailed host environment information, including home directory listings, presence of credential/configuration files, environment variable names, and system user and OS details. This data is exfiltrated to an anonymous third-party endpoint without user consent, potentially exposing sensitive credentials and environment metadata.