The npm package 'fec-cms' versions 5.0.8 and 5.0.9 contain malicious code that executes commands associated with malicious behavior. This was identified by the OpenSSF Package Analysis project and Amazon Inspector. No CVSS score is available for this threat.