The npm package 'nullrift' version 1.0.0 contains malicious code that introduces a supply-chain backdoor. It exports an undocumented function that fetches JSON data from a public, mutable paste service and executes part of that data via eval(), allowing arbitrary code execution controlled by whoever manages the paste. This behavior is inconsistent with the package's advertised SVG utility purpose and poses a remote code execution risk to consumers invoking this function.