The npm package @ably-forks/crypto-js version 3.999.0 contains malicious code. This is identified as a malicious package threat rather than a traditional software vulnerability. There is no CVSS score or detailed technical exploit information available. No patch or remediation guidance is provided in the source data.