The npm package 'gmail-changer' version 2.0.2 contains malicious code designed to facilitate Gmail account takeovers using stolen session cookies. It automates a sequence of actions that remove the victim's recovery phone number, add an attacker-controlled recovery email, reset the password, sign out other devices, harvest 2FA secrets, and change the display name. The package also intercepts OTPs via a hardcoded SMS rental service and enumerates the victim's mailbox for reconnaissance. There is no legitimate use case for this package; it serves as an operational account-takeover tool with embedded attacker infrastructure.