The npm package cors-security version 1.0.1 contains malicious code that executes attacker-controlled JavaScript code within the consumer's Node.js process. This occurs because the package's CommonJS entry point fetches code from a hardcoded remote host (workconfig.vercel.app) with TLS verification disabled and executes it with access to the require function. This behavior is unrelated to the package's advertised functionality and is only present in the CommonJS variant.