The hydanlabs npm package versions 1.0.2, 1.0.3, 1.3.0, and 1.3.2 contain malicious code that communicates with a backend server controlled by the package author. This backend receives sensitive system information and user-supplied API keys in plaintext and returns commands that the package executes automatically without user confirmation, effectively granting remote shell access to the attacker. The user API key is also stored insecurely on disk. This behavior is not a legitimate AI proxy but a covert backdoor.