The hunsterx-package version 7.0.1 on npm contains malicious code that executes during installation. It collects extensive sensitive information including host identity, environment variables, npm tokens, AWS EC2 metadata, and configuration files, then exfiltrates this data to an attacker-controlled domain. The package also confirms successful execution via DNS callbacks. Any system installing this package risks full compromise, requiring immediate secret and key rotation and package removal.