The npm package 'neon-poly-utls' version 1.3.1 contains malicious code executed during its installation. Its postinstall script fetches and runs arbitrary code from an unverified remote URL controlled outside the legitimate publisher's domain, enabling arbitrary Node.js code execution on the installer's machine. The package impersonates a Polymarket SDK and suppresses errors to avoid detection.