The @rockawayx/utils npm package (version 0.0.1) contains malicious code that executes a preinstall script to silently exfiltrate host system information to a hardcoded IP address. This package squats the unclaimed @rockawayx npm scope and sends data such as hostname, username, platform, and timestamp without user consent. The package masquerades as authorized security research but performs unauthorized data transmission during installation. Systems with this package installed should be considered fully compromised.