The npm package test89-auth@1.0.1 contains malicious code that executes during installation. It collects detailed host system information and recursively enumerates filesystem roots, then exfiltrates this data via DNS queries to a remote server. The package has no legitimate authentication functionality and is designed solely for reconnaissance and data theft. Systems with this package installed should be considered fully compromised.