The npm package fastify-client-bundler version 1.4.0 contains malicious code that fetches and executes remote code from a hardcoded IP address. This remote code execution occurs via a function that compiles and runs JavaScript obtained from the endpoint, enabling arbitrary code execution in the Node.js process. The package's declared functionality is a decoy, while the actual behavior includes loading dependencies consistent with a Windows credential and wallet stealer. No official patch or remediation information is provided, and no known exploits in the wild have been reported.