The npm package 'bolt-delivery-menu-app' version 9.9.11 contains malicious code that executes a DNS-based beacon both at install time and on every module require. It collects host identity information such as username, hostname, and current working directory, then exfiltrates this data via DNS queries to an attacker-controlled domain. The package impersonates the Bolt delivery brand and falsely claims no network activity in its README. Installation of this package compromises the host, potentially exposing all stored secrets and keys.