The npm package 'mdb-vite' contains malicious code that fetches and executes attacker-controlled JavaScript code with full Node.js privileges on any system that imports and runs its default export. The package masquerades as a legitimate SDK related to Polymarket and Vite tooling but instead performs a remote code execution via dynamic evaluation of fetched code. This allows an attacker to deliver arbitrary payloads, steal credentials, maintain persistence, or compromise downstream systems.