The npm package @flipbit2-bb/test-auth-state version 0.0.2 contains malicious code that executes a postinstall script collecting host identifiers and sending them to an external webhook. The package masquerades as an internal Atlassian package to exploit dependency confusion. Installation of this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.