The node-sysmon-native npm package versions 1.0.0, 1.0.1, and 1.0.2 contain malicious code that, upon module load, reconstructs a hex-encoded URL pointing to a remote IP address. The package enters an asynchronous loop polling this remote host for shell commands, executes them on the local system with bash, and exfiltrates the output back to the attacker. This behavior grants arbitrary shell execution and data exfiltration capabilities to the operator of the remote server. The package's declared purpose does not justify this network activity, indicating malicious intent.