The npm package leviosa86-test version 4.999.0 contains malicious code that executes host reconnaissance commands and exfiltrates collected data via DNS queries to an attacker-controlled domain. This package appears to be part of a dependency confusion attack, where a high version number is published publicly to override an internal package and trigger the malicious payload during builds.