The npm package @equansservices/tool version 1.0.2 contains malicious code executed during installation. Its postinstall script downloads and runs an attacker-controlled payload from an unauthenticated HTTP CloudFront URL, executing binaries or scripts depending on the platform. The package impersonates legitimate tooling associated with the Equans brand and Anthropic Claude ecosystem, but the payload source is unrelated and unverified. This results in automatic execution of potentially harmful code on any environment running npm install for this package.