The zod-pino npm package versions 1.0.122, 1.0.123, 1.0.124, 1.0.126, and 1.0.127 contain malicious code that executes automatically upon installation. The package masquerades as a logging utility but includes components that perform network reconnaissance, credential harvesting, secret scanning, and exfiltration of data via a Discord relay. Installing this package can lead to full system compromise and unauthorized data disclosure.