The npm package rendezvous-js version 9.9.11 contains malicious code that exfiltrates host identity information via DNS queries during installation and module import. It collects the username, hostname, and current working directory, encoding this data into DNS A-record lookups to an attacker-controlled domain, bypassing typical network filtering. The package's README falsely claims no network or file system access, misleading users. This behavior indicates a supply chain attack through a typosquatting or dependency confusion tactic. Systems with this package installed should be considered compromised.