The npm package 'test-agency-assignment' version 1.0.2 contains malicious code that executes automatically on Windows hosts during installation. It uses a postinstall script to run a Visual Basic Script (VBS) that decrypts and loads a PowerShell payload designed for process hollowing, enabling arbitrary code execution. The package masquerades as a benign telemetry tool but functions solely as a dropper for attacker-controlled code.