The 'cursed-modules' npm package versions 2.0.0 and 999.0.0 through 999.0.3 contain malicious code designed to steal credentials and sensitive environment data. The package uses lifecycle hooks to execute install-time scripts that collect SSH keys, npm configuration, git history, environment variables, and AWS credentials, exfiltrating them to attacker-controlled endpoints. The malicious payload activates only inside containerized CI/CD environments, evading detection on typical developer machines. This is a dependency confusion attack targeting internal package names to harvest private registry credentials and enable further attacks.