The npm package 'ollama-helpers' versions 1.2.1 and 1.2.2 contains malicious code that executes automatically upon installation. It collects extensive sensitive information from the host system, including OS hostname, usernames, git user emails, SSH public key comments, cloud account identifiers, and more, then exfiltrates this data to an anonymous Google Cloud Run endpoint. The package impersonates the official Ollama ecosystem but is unrelated and does not include the expected main executable, confirming it is a pure data exfiltration tool. There is no user consent or opt-out for this telemetry-like behavior. Systems with this package installed should be considered fully compromised.