The npm package lakk-analytics version 9.9.11 contains malicious code that executes during installation. It constructs a DNS query embedding the installer's OS username, hostname, current working directory, and a timestamp, leaking this information to an external domain. This behavior contradicts the package's README claim of no network requests. The package compromises the host system, potentially exposing all stored secrets and keys.