The npm package nativescript-swisspost-imagepicker version 52.31.0 contains malicious code that exfiltrates the installer's internal project name to an attacker-controlled server during installation. This behavior leaks sensitive information about private package namespaces and organizations using the package. The package is identified as a dependency confusion squat targeting an internal Swiss Post NativeScript namespace. The malicious code executes silently on npm install by sending a JSON payload with project details to a hardcoded URL. Removal of the package may not fully remediate the compromise, as the attacker may have gained full control of the affected system.