The my-empty-package npm package version 1.0.0 contains malicious code that executes arbitrary platform-specific commands during installation. The install script runs different shell commands depending on the operating system, including obfuscated PowerShell commands on Windows, which is a common malware evasion technique. After execution, the package hides its malicious behavior by replacing the package manifest and deleting the install script, preventing detection. Although the current payload is benign (opening the calculator), the framework can execute any code with user privileges at install time, posing a serious risk.