The axon-web npm package version 12.0.0 contains malicious code that, upon loading, automatically collects the host's internal hostname and user environment variables and sends this information via a DNS query to a third-party out-of-band listener domain (oast.fun). This behavior occurs without any user interaction and exposes sensitive internal host and user identity information to an external party. The package masquerades as a dependency-confusion proof-of-concept but acts as a data exfiltration vector.