The supersig npm package version 1.0.5 contains malicious code concealed in its distributed bundles that is not present in the source tree. This code decrypts and executes a payload at load time by spawning a new Node.js process and feeding it decrypted code from an external dependency. The decryption key is obtained from an unpinned dependency, allowing the payload to be changed dynamically by whoever controls that dependency. Any system with this package installed should be considered fully compromised.