The npm package 'npm-builderio-qwik-poc' contains malicious code that acts as a browser exploit. When loaded in a DOM context, it creates a hidden iframe targeting pendo.io and injects JavaScript that executes in the pendo.io origin. This script fetches authenticated session data from pendo.io, encodes it, and exfiltrates it to an attacker-controlled webhook URL. The malicious behavior triggers on every load without user consent or configuration. The package does not have Node.js side effects but weaponizes any web application that bundles it against pendo.io users.