The npm package 'anthropic-shared-logger' version 8.0.5 is a malicious package impersonating Anthropic's internal namespace. It contains a postinstall script that executes shell commands on the installer's machine and exfiltrates system information and environment variables to an attacker-controlled server. This behavior is characteristic of a dependency confusion attack, potentially exposing sensitive host data during build processes that mistakenly resolve this package from the public registry.