The npm package @dealmgmt/grid version 1.0.0 installs a dependency from a custom domain that executes an info stealer during installation. This malicious code targets sensitive tokens related to npm, git, and CI/CD environments, potentially compromising developer credentials and automation pipelines.