The npm package zustand.js version 1.0.0 contains malicious code that acts as a multi-stage information stealer. The malicious payload executes upon installation, opening a new terminal and potentially compromising the host system. Any computer with this package installed should be considered fully compromised, and all stored secrets and keys must be rotated immediately from a different, secure machine.