The permcarmserver npm package version 1.0.0 contains malicious code that, upon requiring the module, loads a native aarch64 ELF shared library disguised as an HTML file. This library implements a VLESS-over-WebSocket proxy with a hardcoded client UUID, enabling the infected host to relay arbitrary attacker-directed TCP traffic covertly. The package deletes its own installation directory shortly after activation to evade detection while the malicious proxy continues running in memory, presenting a decoy HTML page to casual HTTP probes.