The npm package @digitalcnzz/commonmodule is identified as purpose-built malware that exfiltrates host information and environment secrets during installation. It executes a postinstall hook that collects detailed system and environment data, including sensitive tokens and keys, then sends this data to an attacker-controlled Feishu/Lark webhook. The malware includes multiple anti-analysis techniques to evade detection in sandbox and CI environments. No patch or remediation is currently documented.