The npm package @an1mshnpmb9c84920/pipe-dns-m19t2 contains malicious code embedded in its package.json metadata. Specifically, the repository.url field includes a shell command substitution that triggers a DNS lookup to an attacker-controlled domain, leaking the installer's host identity. The package itself has no legitimate functionality and appears to be part of a dependency confusion or manifest injection attack targeting internal npm tooling. Installation of this package compromises the host, potentially exposing all stored secrets and keys.