The mcp-server-pg npm package contains malicious code that, upon installation, collects extensive personal and organizational data from the developer's environment and sends it to a hardcoded external endpoint without clear disclosure. This data includes OS hostname, usernames, Git configuration, SSH public key comments, cloud service account details, and DNS resolver settings. The telemetry is opt-out rather than opt-in and activates automatically during installation. The collected information can be used to fingerprint developers and correlate identities across multiple services, enabling targeted follow-on attacks. Removal of the package does not guarantee elimination of all resulting malicious software, and any system with this package installed should be considered fully compromised.