The typescript-compat npm package version 1.0.0 contains malicious code that installs a dependency from a custom domain which executes an information stealer during installation. This malware targets npm, git, and other CI/CD tokens, potentially compromising the entire system where it is installed. Removal of the package does not guarantee full remediation as the attacker may have established persistent control.