The npm package blackbeards-navigator and three related pirate-themed packages contain malicious lifecycle scripts that execute during installation. These scripts search the filesystem for HackTheBox CTF flags or environment variables, encode the collected data, and exfiltrate it to an attacker-controlled server. The packages have no legitimate functionality and are part of a dependency confusion attack with inflated version numbers.