The npm package @secauditb20y/sec-test-r3b version 1.0.0 contains malicious code that executes automatically upon installation. It runs a postinstall script that writes a file outside the package directory on the installer's machine, demonstrating arbitrary code execution. The package claims to be a security test but functions as a dropper, potentially compromising the host system.