The npm package 'building-build' version 1.0.0 contains malicious code that, when loaded, schedules a timer to fetch sensitive privileged same-origin paths and posts their contents to a site endpoint. The package masquerades as a benign library but exists solely to exfiltrate data accessible via the authenticated user's session. Installation of this package compromises the host system, potentially exposing all stored secrets and keys.