The npm package 'nativescript-swisspost-pcc-creative-editor' masquerades as an internal Swiss Post NativeScript package but contains malicious code. During installation, it executes arbitrary Node.js code that leaks the installer's project directory name to a third-party server. This package is a dependency-confusion attack that results in code execution and information disclosure on the installer's system. The package author labels it as a bug bounty proof of concept, but the impact is critical. Any system with this package installed should be considered fully compromised.