The npm package f-termx version 1.2.6 contains malicious code that starts an HTTP and Socket.IO server accessible on all network interfaces. It allows remote attackers to execute arbitrary commands on the host machine via a 'spawn-shell' message, which spawns a local bash shell and forwards input from the network. Additionally, it can open SSH sessions to attacker-supplied hosts using stored credentials, with no authentication on the SSH proxy namespace. The web UI uses hardcoded default credentials 'admin/admin', making unauthorized access trivial.