The mchain-sdk npm package version 4.2.5 is a malicious typosquatting package that executes attacker-controlled JavaScript code both during installation and at runtime. It fetches and runs remote code from a mutable anonymous paste URL disguised as an API key, leading to full system compromise. The package mimics a legitimate library to evade detection. Removal alone may not fully remediate the compromise, and all secrets on affected systems should be rotated immediately.