The npm package 'bubblestring' version 1.1.4 contains malicious code that executes automatically during installation. Its postinstall script runs heavily obfuscated code which downloads and executes a remote payload without integrity checks. The package metadata and README are minimal and misleading, indicating malicious intent. This behavior enables remote code execution under the installer's user privileges.