The redis-type-xyz npm package is a malicious impersonation of the legitimate Redis OM library. It contains no functional code but depends on a known-malicious package ulid-xyz, which installs a persistent background agent capable of system enumeration and deploying arbitrary binaries. Installing redis-type-xyz results in full system compromise, with attacker control established via a WebSocket and HTTP command-and-control server. The package should be removed immediately, and all secrets on the affected system rotated from a clean environment.