The x509-escaping npm package contains malicious code that executes automatically during installation. This code collects sensitive system information including hostname, username, home directory, DNS servers, and reads system files such as /etc/passwd and /etc/hosts. The collected data is then exfiltrated via HTTPS to an attacker-controlled out-of-band domain. The package does not provide legitimate library functionality and appears designed solely for reconnaissance and data theft during dependency installation.