The npm package 'lab-helper' versions 0.0.2 and 0.0.3 contains malicious code that executes during installation. The postinstall script runs a JavaScript file that checks if the host's IPv4 address starts with 18.175., targeting a specific subnet. If the condition is met, it reads a file named 'myfile.txt' from the installer's working directory and exfiltrates its contents to a hardcoded command and control server at http://18.175.63.47:8080/collect. This behavior indicates a targeted supply-chain attack likely aimed at specific AWS or lab environments. Any system with this package installed should be considered fully compromised, and all secrets and keys must be rotated immediately. Removal of the package does not guarantee full remediation due to potential persistence of malicious software.