The npm package 'cryptostock' versions 1.0.0 and 1.0.1 contains obfuscated malicious code that acts as a command-and-control (C2) client. Upon being required, it connects to a remote server to receive shell commands, executes them, and exfiltrates output. It also searches for private key files related to cryptocurrency wallets on the host system, extracts Ethereum private keys, and uses them to transfer funds to an attacker-controlled address.