The npm package @dsft/ft-element version 2.5.9 contains malicious code that executes during installation. Its preinstall script sends a JSON beacon with the installing project's directory name to an attacker-controlled URL without user consent. This behavior leaks potentially sensitive project information and confirms a successful dependency-confusion attack. Although the author claims it is a harmless proof of concept, the unconditional data exfiltration constitutes a supply-chain attack. Systems with this package installed should be considered compromised, and secrets should be rotated immediately.