The npm package 'auto-debug-tool' versions 1.0.0, 1.0.2, and 1.0.3 contains malicious code that executes automatically during installation on Windows systems. The package.json defines a postinstall hook that runs a hidden PowerShell command to download and execute an unsigned binary from a mutable branch of a personal GitHub repository. This execution is concealed by skipping non-Windows platforms and development environments, and by swallowing errors, allowing the payload to remain dormant on developer machines while activating on Windows installations and CI environments.