The npm package eslint-plus versions 6.0.4 and 6.0.5 contains malicious code that executes arbitrary JavaScript with full Node.js privileges during installation. It achieves this by running a detached, hidden child process that fetches and executes code from a publicly editable JSON paste service, allowing the attacker to change the executed payload at any time. The package impersonates legitimate tooling by referencing React Training and eslint but actually includes a copied nodemailer source tree as a cover for the malicious dropper.