The npm package @doaction/example versions 9.9.9 and 99.99.99 contain malicious code. The package's preinstall script delegates execution to a shared dependency whose behavior is unknown and potentially harmful. Installation of this package may lead to full system compromise, requiring immediate secret and key rotation. Removal of the package alone may not eliminate all malicious components.