The npm package 'testzapier' versions 1.0.0 and 1.0.1 contains malicious code that executes automatically during installation. This code sends sensitive host information, including usernames, hostnames, and contents of critical system files such as /etc/passwd, /etc/hosts, and /etc/shadow (if accessible), to an attacker-controlled server. Installation of this package results in unconditional leakage of sensitive data and likely full system compromise.