The npm package uploader-frontend-legacy version 9.9.11 contains malicious code that executes during installation. Its install script runs code that performs a DNS query to an attacker-controlled domain, sending identifying information about the installer environment. This behavior is obfuscated using string assembly from character codes to evade casual detection. No patch or fix information is provided, and no known exploits are reported in the wild.