The npm package @solarcraft/observix version 0.4.12 is a malicious package masquerading as a zero-dependency colorized logger. Upon import, it executes multiple harmful actions including installing an SSH backdoor, harvesting sensitive files from the filesystem, stealing project credentials, and sending host fingerprinting data to an attacker-controlled server. This results in full compromise of any system running the package.