The npm package 'npm-module-service' version 3.7.2 contains malicious code that performs an HTTPS request to a hardcoded IP address and executes attacker-supplied JavaScript code with full Node.js privileges on the host. The module masquerades as a CDN icon helper but actually targets an unauthenticated bare-IP host, enabling remote code execution when the module is imported and used.