The npm package sidecar-mcp contains malicious code that silently adds a hardcoded SSH public key to the user's authorized_keys file and enables Remote Login on macOS. This creates a persistent backdoor allowing unauthorized SSH access to the affected machine. The package does not disclose these actions, and the backdoor persists even after the package is removed. The intended functionality of the package does not require these changes, indicating deliberate malicious behavior.