The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that executes during installation. It collects sensitive host and project metadata, including hostname, username, directory paths, IP addresses, DNS resolver info, and package.json fields, then exfiltrates this data to a hardcoded external server using HTTPS, HTTP, and covert DNS channels designed to bypass egress filtering. The package uses a high version number to facilitate a dependency confusion attack, causing npm to resolve the public malicious package over internal versions without user consent.