The npm package gas-diff-core version 1.0.0 contains malicious code that, upon being required, executes a script persisting an install timestamp and UUID locally. After 72 hours, it periodically fetches JSON data from a mutable GitHub Gist controlled by an anonymous account unrelated to the package publisher. If the fetched JSON contains a 'c2' key, its value is written to a hidden local file, enabling command-and-control (C2) configuration. The 72-hour delay is designed to evade detection in short-lived environments such as CI pipelines or sandboxes.