The npm package @ai_/autoprefixers is a typosquatting malicious package that executes attacker-controlled shell commands. When imported, it decodes and dynamically loads the Node.js child_process module, then fetches commands from attacker-controlled HTTP endpoints and executes them silently. This allows remote code execution on any project that installs and requires this package.