The ai-node-relay npm package contains obfuscated malicious code that, upon being required, immediately starts a public Fastify server listening on all interfaces and collects host fingerprint data. It sends this data to a configurable gateway URL and allows the gateway to overwrite encryption-related environment variables at runtime. While it does not perform credential scraping or remote code execution, the behavior expands trust to the configured gateway and poses a significant risk. The package is considered fully compromising to any system where it is installed or running.