The npm package gs-uitk-object-utils version 9.9.11 contains malicious code that exfiltrates host environment information during installation and when required. It reads the OS username, hostname, and current working directory, then encodes and sends this data via DNS queries to an attacker-controlled domain. This behavior is concealed through obfuscated code and is inconsistent with the package's purported utility functionality.