The kdrive-utils npm package version 99.9.9 contains malicious code that executes a preinstall script during npm install. This script sends the installer's hostname and current OS username in a plain HTTP request to an attacker-controlled server, enabling reconnaissance and potential further compromise. The package is a dependency confusion attempt with no legitimate functionality. Systems with this package installed should be considered fully compromised, and secrets should be rotated immediately.