The npm package @saif777/codemirror5 is a malicious typosquatting package impersonating the CodeMirror 5 editor library. It uses inflated version numbers to override legitimate packages in environments with private registries. Upon installation, it executes a postinstall script that collects detailed system information including public IP, username, hostname, CPU model, RAM, working directory, and OS platform, then exfiltrates this data via a Discord webhook. The payload includes sandbox and bot detection mechanisms to evade analysis. Systems with this package installed should be considered fully compromised.