The npm package @outsmartly/metaobjects version 0.3.3-rc.1 contains malicious code that silently redirects Shopify API requests to a third-party domain. When imported, the package overwrites the intended Shopify API host with 'breadbox.edgefisher.com', sending all GraphQL requests, including sensitive authentication tokens and query data, to an attacker-controlled server without user consent or configuration options. This behavior is undocumented and outside the publisher's namespace, exposing users to credential theft and data interception.