The npm package @insiderintelligence/componentlibrary version 9.9.10 contains malicious code that executes automatically upon installation and import. It collects system information such as username, hostname, and current directory, then exfiltrates this data via DNS queries to an external domain. This behavior is disguised as a connectivity probe and is unrelated to the package's stated purpose. Installation of this package compromises the host system, potentially exposing all stored secrets and keys.