The npm package @ziedzzz/demo-canary version 1.0.0 contains a malicious install hook. package.json declares a postinstall script that runs index.js, which builds a host fingerprint containing the hostname, username, home directory, operating system, CPU and memory details, internal IP and MAC addresses, current working directory, Node executable path, and the names of all environment variables matching TOKEN, SECRET, KEY, PASS, AWS_, GCP_, AZURE_, SSH, GIT, NPM or DOCKER. The fingerprint is sent as URL query parameters over HTTPS to an attacker-controlled endpoint at telegrambot-aebk.onrender.com/ping. The package also exports decoy sensor-parsing functions to look like a real utility. The self-description as a classroom fixture does not change the behavior of a public package that exfiltrates host reconnaissance data without consent on install.