The npm package @remitee-money-transfer/rmt-base versions 99.99.99, 99.99.100, 99.99.102, and 99.99.104 contains malicious code. It includes a preinstall script that reads sensitive files (/etc/passwd and /root/.ssh/id_rsa) and exfiltrates them along with the host's public IP to an attacker-controlled server. The package impersonates a legitimate internal package using dependency confusion techniques and contains no legitimate functional code.