The npm package 'ft-flow' version 9.9.0 contains malicious code that installs an info stealer during installation. This info stealer targets npm, git, and other CI/CD tokens, potentially compromising secrets and keys on the infected computer. Removal of the package does not guarantee full remediation as the attacker may have gained full control of the system.