The npm package 'oracle-redis' is a malicious package that masquerades as the popular 'ioredis' library by copying its README, source tree, and repository URL. It adds two extra runtime dependencies that are not part of the genuine ioredis package and are never used by the included code. Installing 'oracle-redis' causes these additional dependencies to be installed and their lifecycle scripts executed, potentially delivering malicious payloads. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated immediately. Removal of the package alone may not eliminate all malicious software resulting from its installation.