The npm package mcp-audit-sync-internal version 99.9.9 contains malicious code that executes automatically during installation on Windows systems. It runs a hidden PowerShell process that downloads and executes an unverified executable from an anonymous file host. This behavior enables arbitrary code execution on the host machine without user awareness. The package metadata attempts to disguise this activity with misleading descriptions and filenames.