The npm package node-calculator-f4d5 version 2.3.0 contains malicious code. It communicates with a domain linked to malicious activity and executes commands associated with harmful behavior. This package is identified as malicious by multiple sources including Amazon Inspector and the OpenSSF Package Analysis project.