The npm package @salem_jalal/osc-components version 1981.17.7 contains malicious code that exfiltrates sensitive information. Its postinstall script sends host identifiers to a remote server over unencrypted HTTP. Additionally, when loaded in a browser context, it harvests cookies, localStorage data, the current URL, and user agent details, sending them with credentials to the same remote server. The package impersonates another namespace (@dx-ui) to facilitate dependency confusion attacks.