The npm package 'airbnb-flow' version 1.0.0 was found to contain malicious code that installs a dependency from a custom domain. This dependency acts as an information stealer during installation, targeting sensitive tokens related to npm, git, and CI/CD environments.