The @baanx/abis npm package version 9.9.11 declares an install script that executes code loading a module which collects sensitive host information (OS username, hostname, current working directory basename) and sends it via DNS resolution requests to a malicious domain (oob.algamil7x.xyz). The code is obfuscated using character code hex arrays and disguised with comments suggesting telemetry functionality. This exfiltration occurs automatically on npm install and on require, indicating persistent malicious behavior. The package is unrelated to legitimate smart-contract ABI libraries and represents a supply chain compromise.

Any system with @baanx/abis version 9.9.11 installed or running is considered fully compromised. The attacker-controlled DNS queries leak host identity information, and the presence of this package implies potential full control by an attacker. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

Immediate removal of the @baanx/abis package version 9.9.11 is required. All secrets and keys stored on the affected system should be rotated from a separate, trusted environment. Due to the potential full compromise, consider rebuilding or restoring the system from a known good backup. No official patch or fix is available; the package itself is malicious. Monitor for any signs of persistent compromise beyond the package installation.