The npm package @zmtcdn/components version 9999.0.0 is a malicious dependency-confusion package. Its postinstall script collects system information including hostname, username, platform, working directory, and environment variable names, then sends this data to an external logging service. This reconnaissance can expose sensitive environment variables such as CI or secret tokens, potentially leading to credential theft. The package was published by the npm account kill_shs, which also published a similar malicious package @zmtcdn/ui.