The npm package zxcvb90-utils-helper version 1.0.1 contains malicious code that exfiltrates the page DOM content to an attacker-controlled webhook URL whenever it is imported or required in environments supporting document and fetch (such as browsers, jsdom, or Electron). This behavior occurs silently and can leak sensitive information including secrets, tokens, or user data rendered in the page. The package has no legitimate declared purpose and includes a self-dependency with an unpinned pre-release version range, allowing dynamic resolution of potentially malicious code.