The npm package async-mutex-hook version 2.1.0 is a malicious package that masquerades as a Promise-based mutex library but contains no actual mutex implementation. Instead, it executes attacker-controlled JavaScript code by fetching a payload from a hardcoded IP address and running it with full Node.js privileges. The package includes unrelated dependencies commonly used for stealing browser credentials and Windows DPAPI secrets, indicating its intent to facilitate credential theft.