The npm package 'tanksync' version 1.0.7 contains malicious code that downloads and executes arbitrary JavaScript from a hardcoded remote URL. The package uses a flawed integrity check with a symmetric key embedded in the source, allowing attackers to produce valid signatures for any payload. Execution occurs in a detached Node.js process that continues running after the client closes, potentially compromising the host system. Removal of the package may not fully restore system integrity due to persistent malicious activity.