The npm package @wololasod/tiny-id, advertised as a tiny ID generator, contains malicious code in its main entry point. The code uses obfuscation and an RC4 string-array virtual machine to download and execute a remote payload specific to the platform (Windows or Linux). It runs the payload as a hidden, detached process that persists beyond the parent process. The package also improperly includes executable code in a TypeScript declaration file, which should only contain type definitions. This behavior is unrelated to the advertised functionality and indicates malicious intent.