The npm package 'encrypt-string-safe' version 2.2.0 contains malicious code that fetches and executes attacker-controlled JavaScript from a lookalike domain over unencrypted HTTP. The package's index.js is heavily obfuscated to conceal this behavior. Any use of the package's documented API results in remote code execution within the caller's process.