The '@baanx/blockchain-config' npm package version 9.9.11 includes malicious code embedded in obfuscated scripts that run during the install lifecycle and module loading. The code collects sensitive system information such as os.userInfo().username, os.hostname(), and the basename of process.cwd(), concatenates these with a static tag and a timestamp, and sends this data via DNS resolution requests to a non-affiliated external domain 'oob.algamil7x.xyz'. The obfuscation uses hex-decoded byte arrays and dynamic module loading to evade static analysis. This exfiltration occurs automatically on 'npm install' and on requiring the package, indicating a supply chain compromise.

Any system with this package installed or running is considered fully compromised. The malicious code exfiltrates sensitive system identity information to an attacker-controlled domain, potentially allowing unauthorized access or further exploitation. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure, unaffected environment. Removal of the package alone does not guarantee elimination of all malicious artifacts or backdoors.

Immediate removal of the '@baanx/blockchain-config' package version 9.9.11 is required. All secrets, credentials, and keys stored on the affected system should be rotated from a different, trusted machine. Due to the full compromise risk, a thorough system investigation and remediation are recommended. No official patch or fix is indicated; users should avoid this package version entirely.