The npm package 'gekko-trading-bot' version 4.2.0 contains malicious code that downloads and installs an attacker-controlled executable named core.exe during installation on Windows systems. This executable is fetched from a Cloudflare Workers subdomain impersonating MetaMask but unrelated to the legitimate Gekko trading bot. The package metadata misleads users by mimicking the legitimate project while pointing to a different repository. The malicious binary is placed in the user's home directory without verification, posing a significant security risk.