The eslint-comments npm package version 9.9.1 contains malicious code that installs a dependency from a custom domain which runs an information stealer during installation. This malware targets npm, git, and other CI/CD tokens, potentially compromising the entire system where the package is installed. Removal of the package does not guarantee full remediation as the attacker may have gained persistent control.