The pure-folder-three npm package versions 0.5.0, 0.6.0, 0.7.0, 0.7.1, and 0.7.3 contain malicious code that executes attacker-controlled shell commands both during installation and when the package is imported. The malicious code fetches a payload from a remote server and executes it, giving the attacker arbitrary command execution on the host. The payload is obfuscated and includes a check to avoid execution on machines with usernames containing 'justin'. This results in a full compromise of any system running or installing the affected package versions.