The datavaultx npm package version 1.7.1 contains malicious code that acts as a two-stage dropper. When required, it attempts to load an undeclared dependency 'auth-gen-next'; if missing, it silently installs this attacker-controlled package at runtime and loads it. This design allows the real malicious payload to be fetched dynamically without being part of the original package dependencies. The package also uses obfuscated error messages and suppressed logging to hide this behavior.