The npm package math-helpers-extra-utils@1.0.0 and 1.0.1 contains malicious code that masquerades as a utility library but includes a hidden payload. This payload executes system commands to gather host environment information and sends it to a third-party collector URL. The package abuses Wix's internal registry names to inject this exfiltration code into Wix's build pipeline, enabling host reconnaissance and data leakage.