The npm package trimprompt versions 1.0.35, 1.0.42, 1.0.46, 1.0.47, 1.0.48, and 1.0.49 contains heavily obfuscated JavaScript modules that execute malicious behavior. These modules include scripts that spawn PowerShell processes during installation and runtime on Windows hosts, and perform HTTP POST requests sending host identifiers to remote endpoints. This behavior is inconsistent with the package's intended functionality and indicates a supply-chain compromise with install-time execution and host beaconing capabilities.