The @uisp/utils npm package versions 99.0.0, 99.0.1, and 99.0.2 contain malicious code that executes automatically during installation. The package's preinstall script runs a command to identify the host user and exfiltrates this information encoded via DNS and HTTPS requests to an attacker-controlled server. This results in remote code execution at install time and leakage of host identity information.