The npm package fetchrtds version 1.1.0 contains malicious code executed during installation. Its postinstall script fetches and runs arbitrary code from an unverified remote URL unrelated to the package publisher, enabling arbitrary Node.js code execution on the installer's machine. The package's advertised functionality does not match the delivered payload, which is loaded dynamically at install time.