The croft-node npm package version 1.1.3 contains malicious code executed during installation. Its postinstall script fetches and executes remote code from an attacker-controlled endpoint, enabling remote code execution on the installer's host. This behavior is unrelated to the package's documented functionality as an in-memory cache. No official patch or remediation guidance is currently provided.