The npm package 'luluking3' version 0.0.1 contains malicious code that executes during installation. Its postinstall script reconstructs an obfuscated URL and shell command to download and execute a remote JavaScript file from a mutable third-party Aliyun OSS bucket controlled by the package publisher. This allows arbitrary code execution with the privileges of the user running 'npm install'. The obfuscation indicates an attempt to evade detection by static analysis tools.