The npm package 'type-context' versions 3.2.7, 3.2.8, 3.2.9, and 3.2.11 contains malicious code that executes attacker-controlled JavaScript on the host. When imported and used, it runs a detached Node child process that fetches code from remote paste-style services and executes it with full module loader privileges. This allows an attacker to gain full control over the compromised system. Removal of the package does not guarantee elimination of all malicious software installed via this backdoor. Immediate secret and key rotation is recommended for affected systems.