The npm package @zaka13/thing version 1.0.0 contains malicious code that acts as a disguised in-browser proxy. It XOR-decodes endpoints with a fixed key, injects remote scripts from a suspicious domain, and establishes a WebSocket proxy routing traffic through attacker-controlled relays. The package does not run install scripts but causes harm when its assets are served in a browser environment. Systems with this package installed should be considered fully compromised.