The npm package mamadoos-test contains malicious code that executes a preinstall script during npm install. This script sends the installer's OS username, hostname, and current working directory to a third-party URL without user consent. The package also declares itself as a dependency, consistent with dependency confusion tactics to capture internal environment details. This behavior can lead to unconsented exfiltration of host-identifying information useful for follow-on attacks.