The permcserver npm package contains malicious code that, when imported, starts a native proxy server embedded in a bundled shared library. This proxy server authenticates clients using a hardcoded UUID and allows authenticated users to tunnel TCP traffic through the host machine, effectively turning it into a backdoor. The package disguises itself as a Minecraft/Pterodactyl server helper by serving decoy content, but its true function is to provide attacker-controlled network relay and arbitrary native code execution within the Node.js process.