The npm package 'elephant-array-utils' version 1.0.6 contains heavily obfuscated malicious code that acts as a remote payload dropper. Upon requiring the package, it contacts a hardcoded IPv4 address to download an encrypted payload, decrypts it, writes it to disk, and executes it, enabling arbitrary code execution. The package name appears to be a typosquat lure. No official patch or remediation information is provided.