The dynamic-import-node npm package version 1.0.0 was found to install a dependency from a custom domain that executes an information-stealing payload during installation. This malicious code targets sensitive tokens related to npm, git, and CI/CD environments, potentially compromising developer credentials and automation pipelines.