The npm package img-to-native contains malicious code that decrypts and writes a Windows executable to the local filesystem with execute permissions. This executable is hidden as an encrypted payload appended to an image file in a dependency, and the package installs attacker-controlled code without verification. Installing or loading this package can lead to full system compromise. The package versions 1.0.0, 1.0.1, 1.0.2, and 1.0.3 are affected.