The neon-postgres npm package versions 3.5.0 and 3.5.1 contain malicious code that executes a shell command upon import. This command stages, commits, and pushes all untracked and uncommitted files in the current working directory to the configured git remote, potentially leaking sensitive information and overwriting repository state. The package impersonates a legitimate Neon serverless-postgres client, making the malicious behavior stealthy and unexpected.