The npm package @devmikets/hyperliquid-sdk version 1.9.6 contains malicious code delivered via a typosquatted tarball URL for the 'inquirer' dependency. This causes arbitrary code execution on any system installing this package version. The package mimics a legitimate trading SDK but includes a suspicious dependency that acts as a delivery vector for malware. Systems with this package installed should be considered fully compromised.