The npm package @dsft/ft-utils version 1.5.8 is a malicious package designed as a proof-of-concept for dependency confusion attacks. Upon installation, it executes a preinstall script that collects the installing project's directory name and sends this information along with a package identifier and timestamp to a remote third-party server without user consent. The package provides no legitimate functionality and acts solely as an install-time beacon. Systems with this package installed should be considered fully compromised, and all secrets and keys on the affected system should be rotated immediately from a different, trusted machine.