The npm package compliancepolicyserv version 9.9.11 contains malicious code that executes during installation and import. It collects system information such as username, hostname, and current working directory, then sends this data via DNS queries to an attacker-controlled domain. The package masquerades as a compliance policy service but performs no legitimate function beyond this data exfiltration.