The npm package ecto-corsair-flag-7kq3mz (versions 1.0.0, 1.0.1, and 1.0.2) contains malicious code that executes during installation. Its postinstall.js script collects sensitive environment information and searches the filesystem for flag-like strings, then exfiltrates this data to an attacker-controlled server. The package also attempts to detect successful dependency confusion attacks. Installing this package results in unauthorized data exfiltration.