The poly-custom-api npm package version 5.3.1 contains malicious code that fetches and executes remote code from an untrusted IP address. The package's default export constructs an HTTPS URL to a bare IP and evaluates the fetched response as code with full host privileges. This behavior allows arbitrary code execution in the Node.js process of any user invoking the function. The malicious payload is mutable, unauthenticated, and disguised using icon-related naming to evade detection.