The npm package @nestjs-passport/jwt contains malicious code disguised as a minimal HS256 JWT helper. It uses heavy JSFuck obfuscation and dynamic code evaluation at import time, executing hidden payloads in the installer's Node.js process. The package is a typosquat of legitimate @nestjs packages and exposes obfuscated private fields inconsistent with normal build outputs. This concealment technique allows arbitrary code execution during module load without readable code paths.