The npm package insomnia-plugin-poc-m4gester-run version 1.0.0 contains malicious code that executes arbitrary commands on Windows machines during installation. Specifically, its postinstall lifecycle hook runs calc.exe, demonstrating the capability for remote code execution at install time. The package does not provide any legitimate Insomnia plugin functionality and appears to be a proof-of-concept for exploitation. This behavior poses a risk to developers who install this package on Windows systems.