The hachutis npm package versions 1.0.0 and 1.0.6 contain malicious code in undeclared prebuilt executables included in the package tarball. These executables are not referenced in the package manifest and include a large Bun-compiled binary that opens a network tunnel to an attacker-controlled Cloudflare Tunnel domain. The package README instructs users to run one of these binaries to 'activate' the package, which establishes a covert channel from the user's host to the attacker, potentially enabling unauthorized remote access or data exfiltration.