The npm package ecinc-cloud-moaxmpp versions 9.7.1 and 9.7.2 contains malicious code exhibiting multiple harmful behaviors including Office document access and encryption, database interaction, local storage clearing, and arbitrary code execution. It includes a native bridge enabling execution of arbitrary SQL queries on a mobile device's database within a specific mobile application context. This allows direct raw access to the device's database through functions such as execute, rawQuery, rawInsert, rawUpdate, and rawDelete. This malicious functionality is triggered when the environment is not a web context, indicating targeted misuse in mobile app environments.