The npm package ts-poly-utls version 1.2.4 contains malicious code executed during installation. Its postinstall script downloads and runs unverified code from a third-party Vercel deployment controlled by an attacker. The package identity is inconsistent with its documentation, misleading users. Installing this package results in execution of attacker-controlled code on the installer's machine.