The npm package cdn-img-fetch versions 1.0.0 and 1.0.1 unconditionally downloads a file from a mutable third-party GitHub repository at module load time and writes it to a hidden temporary file on the installer's system. This behavior occurs automatically upon import without user interaction and does not verify the source content's integrity. The package's advertised functionality does not justify this import-time network fetch and hidden file write, indicating malicious intent as a first-stage dropper mechanism.