The npm package 'alpha-helper' version 1.3.4 contains malicious code that executes attacker-controlled JavaScript with full Node.js privileges. The exported function makes an HTTPS request to a hardcoded IP address and uses the response to dynamically construct and run code via the Function constructor. The package disguises itself with unrelated documentation and dependencies consistent with credential extraction. This behavior allows arbitrary code execution in any environment that imports and runs this package.