The w-screenctl npm package versions 1.0.4, 1.0.6, and 1.0.7 contain malicious code that starts an unauthenticated HTTP server bound to all network interfaces. This server exposes endpoints that allow arbitrary JavaScript execution in a controlled Chrome instance and system-wide keyboard and mouse input injection. This enables remote attackers on the network to execute arbitrary commands and potentially achieve full remote code execution on the host system.