The npm package bootstrap-custom-ui version 5.7.2 contains malicious code that performs a remote HTTPS request to a hardcoded IP address and executes returned code with full Node.js context. This behavior is hidden behind decoy references to legitimate CDNs and contradicts the package's advertised purpose as a React/Bootstrap UI component library. Any user invoking the exported function risks arbitrary code execution on their host system.