The npm package @leejungkiin/awkit contains malicious code that executes during installation. It runs a script that fetches and executes a shell script from a third-party GitHub repository on an unpinned mutable branch, allowing remote code execution with full shell privileges. The malicious script can modify the environment, install additional binaries, or exfiltrate data. Multiple specific versions of the package are affected.