The npm package @baanx/abis version 9.9.11 contains malicious code that performs DNS-based exfiltration of the installer's host identity. During installation and runtime, it collects the OS username, hostname, and current working directory name, combines these with a timestamp and a specific prefix, and sends this data via DNS queries to an attacker-controlled domain. This behavior is disguised under misleading telemetry and connectivity probe comments. The package compromises the host system, potentially exposing all stored secrets and keys.