The node-array-plus npm package versions 1.0.9 and 1.1.9 contain malicious code that executes remote payloads upon import. The package is heavily obfuscated and, when required, contacts a hardcoded IPv4 address to download an AES-256-CBC encrypted payload, which it decrypts and executes on the local machine. The package exposes no legitimate functionality and is designed solely to drop and run remote code stealthily.