The npm package 'booking-eligibility' version 1.0.0 contains a malicious postinstall script that attempts to execute a Windows Script Host (WSH) VBScript file named '4444.vbs' during installation. This script is not included in the package tarball, meaning the hook either fails or could execute attacker-supplied code if the file is provided by other means. The package's README falsely claims there are no installation scripts, misleading users about its behavior. The '4444.vbs' filename suggests a potential reverse-shell payload, indicating malicious intent. The package does not provide legitimate functionality to justify this behavior.