The npm package @telekom-ods/react-ui-kit version 2.6.9 contains a malicious install hook that executes a shell command to exfiltrate local system information and files. It reads sensitive files such as /etc/passwd, /etc/hosts, and conditionally /etc/shadow, along with user and host identifiers, then sends this data via an HTTP POST to an attacker-controlled out-of-band interaction service. The package was published under a legitimate maintainer account, indicating a possible supply-chain compromise. The malicious version has been removed from npm, but any environment that installed it should consider local credentials and password hashes compromised and rotate them accordingly.