The npm package 'cbr-internal-utils' version 2.2.2 contains malicious code that executes a shell command to read the /etc/passwd file on the host system whenever the package is required. This behavior occurs unconditionally without any user action or configuration. The package's metadata is minimal and suspicious, indicating it may be a dependency-confusion or reconnaissance payload rather than a legitimate library.