The npm package mobicwkgjmx version 1.0.0 is identified as malicious. Although static and dynamic scans of the package files did not reveal direct evidence of credential theft or typical malware behaviors, the package is considered fully compromising to any system where it is installed. Removal of the package does not guarantee elimination of all malicious components, and any secrets or keys on the affected system should be rotated immediately from a separate, uncompromised device.