The npm package @torbeck/priority-queue republishes the legitimate @datastructures-js/priority-queue package but uses npm aliasing to substitute a dependency with a malicious package @torbeck/heap. This substitution causes the malicious @torbeck/heap package to be loaded instead of the legitimate dependency, potentially compromising any system that installs @torbeck/priority-queue. The malicious payload resides in @torbeck/heap and can lead to full system compromise. Immediate removal and secret/key rotation are recommended if this package was installed.