The npm package @mgor/fw-canary-20260725-394b024b version 0.0.2 contains malicious code that executes an unpinned, unverified shell script from a third-party domain during import or require. This behavior contradicts the package's description and README, which falsely claim it is an inert security-test canary with no install scripts or functionality. The execution of this remote script results in arbitrary code execution on the host system of any user installing or importing the package.