The npm package @vertexa/prisma-fetch-engine is a malicious package impersonating the official Prisma fetch engine. It downloads and executes attacker-controlled native binaries from an unaffiliated personal GitHub repository without verifying their integrity. This allows arbitrary native code execution when the package is installed and used as part of the Prisma tooling.