The npm package @gitlab-test/pnpm-v9 versions 0.3.0 and 0.4.0 contains malicious code that installs an info stealer during installation. This malware targets and steals npm, git, and CI/CD related tokens, potentially compromising secrets and keys on the infected system. Removal of the package does not guarantee full remediation as the system may be fully compromised.