Version 7.0.4 of the npm package intercom-client was published using compromised developer credentials and contained a malicious payload. This payload executed during installation and harvested sensitive credentials from the environment, including cloud provider keys and tokens. The compromised version was available for approximately two hours before removal. Downgrading to version 7.0.3 or earlier mitigates the issue. Any environment where version 7.0.4 was installed should consider credentials compromised and rotate them immediately.