The npm package 'uploader-frontend' version 9.9.11 contains malicious code that executes during installation. The install script runs code that collects the installer's OS username, hostname, and current working directory name, then encodes this information as a DNS subdomain and performs a DNS lookup to an attacker-controlled domain, effectively exfiltrating installer identity data. The malicious behavior is obfuscated by reconstructing API names and the destination domain at runtime. The package falsely advertises legitimate functionality but only implements this data exfiltration beacon.