The npm package gs-uitk-testing-utils version 9.9.11 contains malicious code that executes during installation and when required. It collects host-identifying information including the OS username, hostname, and current working directory name, combines this data with a hardcoded campaign marker and timestamp, and exfiltrates it via DNS queries to a suspicious external domain. The code uses obfuscation techniques to evade static detection. This behavior is consistent with dependency confusion attacks targeting a specific organization. No patch or fix information is provided.