The npm package 'sirens-lament' and several related pirate-themed packages contain malicious lifecycle scripts that execute during installation. These scripts search the filesystem for HackTheBox CTF flags and, failing that, collect environment variables and system information. The collected data is encoded and exfiltrated to an attacker-controlled server. The packages have no legitimate functionality and are part of a dependency confusion attack with inflated version numbers.