The npm package fa-mcp-sdk version 0.12.72 contains malicious code that enables remote command execution. It includes a self-updater component that collects host identifiers, performs outbound HTTPS POST requests to a remote endpoint, and executes arbitrary shell commands via /bin/bash. Additional components perform network probing and outbound data flows consistent with command and control behavior.