The npm package react-native-ui-message version 1.0.0 contains malicious code executed during installation. It collects the host's MAC address and other environment details, sends them to a remote server, then downloads and executes arbitrary JavaScript code from that server without proper integrity verification. This behavior effectively compromises any system installing the package, allowing remote code execution controlled by the attacker.