The npm package wealthsimple-mcp-server version 99.0.0 contains malicious code that installs a dependency from a custom domain. This dependency executes an information stealer during installation, targeting sensitive tokens related to npm, git, and CI/CD environments.