The npm package ts-utility-plus version 1.3.2 contains malicious code that performs an HTTPS request to a hardcoded IP address. The response includes code that is dynamically executed within the Node.js process, enabling arbitrary code execution. The malicious payload masquerades as Font Awesome icon CDN traffic and may deliver a credential or browser secret stealer. This behavior occurs whenever the package's default export function is called.