The npm package @dmangal/curse-dependent-ecto contains malicious code embedded in its binding.gyp file. During installation, it executes a node script that searches for files containing the marker 'HTB{' and reads sensitive files and environment variables. It then exfiltrates this data, including CI secrets and API tokens, to an attacker-controlled endpoint. The package uses an implausibly high version number consistent with a dependency confusion attack. Installing this package in developer or CI environments risks leaking confidential information to attackers.