The npm package '@baanx/blockchain-config' version 9.9.11 contains malicious code that executes automatically during installation and when required. It performs an obfuscated probe that collects system information including the username, hostname, and current working directory, then exfiltrates this data via DNS queries to an external domain unrelated to the legitimate publisher. This behavior indicates a compromise of any system where the package is installed, potentially exposing all stored secrets and keys.