The react-icons-svgo npm package contains malicious code that executes a hidden command to install a third-party module at runtime. This module is not declared in dependencies and is controlled by an external publisher, enabling arbitrary remote code execution when the package's SVG-related API is used. The package impersonates popular libraries but provides no legitimate functionality beyond this covert behavior.