The npm package @aubea/mars contains malicious code that, when run via its CLI, opens a WebSocket connection to a hardcoded third-party relay server. This connection allows a remote party controlling the relay to drive file edits and execute tools on the local machine where the CLI is run. The relay server is not affiliated with the package publisher and is hardcoded without override options. This behavior occurs only when the CLI is invoked and does not involve install-time hooks.