The npm package '@checkrhq/adjudication-api-client' version 0.0.2 contains malicious code that executes a preinstall script. This script sends host and user identification data, including hostname, current user, working directory, and user/group IDs, to an external collector controlled by the attacker. The package impersonates an internal organizational namespace and contains no functional code, consistent with a dependency confusion beacon attack. Installing this package results in unauthorized data exfiltration to a third-party endpoint.