The npm package @shared-runtime/modules version 9.9.10 contains malicious code that collects the installer's OS username, hostname, and current working directory basename. It then leaks this information via DNS queries to an attacker-controlled domain. The malicious behavior is obfuscated and triggered both during installation and when the package is required, while suppressing errors to avoid detection.