The npm package 'commonweb-flow' contains malicious code that executes arbitrary commands and communicates with a domain linked to malicious activity. Certain versions of this package declare a dependency hosted outside the npm registry, which runs install scripts from a mutable tarball, enabling remote code execution during installation. The package metadata appears to be a dependency-confusion lure, potentially targeting internal builds that mistakenly fetch this malicious public package.