The npm package 'lovable-tager' is a typosquatting malicious package impersonating the legitimate 'lovable-tagger' Vite plugin. Its ESM build contains obfuscated malicious code appended after the clean plugin code, which executes attacker-controlled code when loaded in a Node environment. This code can access require, filesystem, and network capabilities of the build host. The CommonJS build does not contain this payload, indicating the malicious code was added post-build and hidden via tab padding. Versions 1.4.0 and 1.4.1 are affected.