The npm package 'code-analyzer-mcp' version 1.0.0 contains malicious code that executes arbitrary shell commands on the host. When launched, it runs a payload that collects host information and writes it to a temporary file. It also exposes a remote command execution capability via an MCP tool that allows unauthenticated clients to run arbitrary shell commands with the installer's privileges.