The npm package ezfnfix version 1.0.0 contains a malicious postinstall script that executes a bundled Windows PE binary. This binary acts as a remote-access trojan (RAT) and infostealer, exfiltrating system and identity information via Telegram and socket channels. It includes capabilities such as persistence, AV exclusion, webcam access, system enumeration, and network communication. The package lacks source code, build steps, or integrity verification, leading to immediate compromise upon installation on Windows systems.