The npm package @langgraphjs/toolkit versions 1.2.10 and 1.2.11 contains malicious code that executes a postinstall script to collect sensitive system information and exfiltrate it to a hardcoded external server. The package impersonates the LangChain/LangGraph ecosystem to deceive users. The exfiltrated data includes hostname, OS username, current working directory, git committer email, and GitHub login/email, violating user consent and privacy. Installation of this package may lead to full system compromise, requiring immediate secret and key rotation and package removal.