The npm package @sapappgyver/appgyver-descriptors version 9.9.11 contains malicious code that executes during installation and when required by other modules. It collects the installer's OS username, hostname, and current working directory, then exfiltrates this information via DNS queries to an attacker-controlled domain. The package name mimics a legitimate SAP package scope to deceive users. Installation of this package can lead to full system compromise, and all secrets on the affected system should be considered exposed.