The npm package '@shared-web/utils' version 9.9.10 contains malicious code that executes during installation. It collects the installer's username, hostname, and current working directory name, concatenates these with a fixed prefix and timestamp, and sends this information via a DNS query to a hardcoded external domain. The code uses obfuscation techniques to hide the destination domain and Node.js built-in module names, and it performs the DNS query automatically on every install without exposing any legitimate functionality.