The npm package @gitlab-test/bun-v1 version 0.3.0 contains malicious code that installs an info stealer during installation. This info stealer targets npm, git, and other CI/CD tokens, potentially compromising secrets and keys on the affected computer. Removal of the package does not guarantee elimination of all malicious software, and any secrets stored on the compromised machine should be rotated immediately from a different device.