The npm package async-mutex-v3 version 3.1.0 is a malicious typosquat that executes attacker-controlled JavaScript code with Node.js privileges. Its default export makes an HTTP request to a hardcoded IP address and runs the returned code, enabling remote code execution. The package masquerades as an icon CDN helper but actually includes dependencies consistent with credential-stealing post-exploitation tools. Any user importing and invoking the default export will execute arbitrary code from the attacker-controlled server.