The npm package fluterjs version 1.0.0 contains malicious code that starts an Express server exposing a POST endpoint /ejecutar. This endpoint accepts a JSON field 'comando' and executes it directly on the host system without any authentication, origin checks, or command restrictions. This behavior effectively creates a remote shell backdoor, allowing any network-accessible attacker to execute arbitrary commands as the user running the package. The package masquerades as a terminal helper but is intentionally designed to provide unauthorized remote code execution.