The npm package 'react-tabulix-virtual' versions 0.1.0 and 0.1.1 contains malicious code that executes during installation. The package's preinstall script runs a JavaScript file that fetches and evaluates remote code from an obfuscated URL, allowing arbitrary code execution with the installer's privileges. This behavior is hidden through base64 encoding and character code assembly to evade detection.