The itc-actors-api npm package version 99.0.0 contains malicious code that collects host identifiers and user information such as hostname, username, platform, and current working directory. This data is transmitted via HTTPS to an external endpoint, indicating reconnaissance activity typical of supply-chain attacks. Installing or running this package compromises the host, potentially giving attackers full control and access to stored secrets and keys.