The npm package 'type-swap' version 3.1.3 contains malicious code that executes a concealed detached child process. This process fetches and executes remote JavaScript code, enabling arbitrary code execution within the installer's Node environment. The package impersonates a legitimate logging library to evade detection. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system must be rotated immediately. Removal of the package does not guarantee elimination of all malicious components.