The @insiderintelligence/componentlibrary npm package version 9.9.10 includes a malicious script that runs automatically during npm install and when the package is required. The script loads a module that gathers sensitive system information (os.userInfo().username, os.hostname(), current working directory leaf) and encodes this data into a DNS query sent to oob.algamil7x.xyz, bypassing HTTP egress controls. The malicious code is obfuscated using String.fromCharCode arrays and dynamic module loading to disguise its true purpose as a connectivity probe. This exfiltration occurs without user consent and is unrelated to the package's declared functionality as a component library.

Any system with this package installed or running is considered fully compromised. The attacker may have gained control over the host, and all secrets, credentials, and keys stored on the system should be assumed exposed and rotated immediately. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the package.

Immediate removal of the @insiderintelligence/componentlibrary package version 9.9.10 is recommended. All secrets and keys stored on the compromised system should be rotated from a secure, uncompromised environment. Due to the potential full compromise, a thorough incident response and system rebuild may be necessary. No official patch or fix is available for this malicious package; remediation involves removal and secret rotation.