The npm package 'imgbundle' versions 1.0.0 and 1.0.1 contains malicious code that does not perform its advertised image bundling function. Instead, it decrypts an AES-256-CBC encrypted file from a sibling dependency 'cdn-img-fetch' using a hardcoded key, writes the decrypted content to disk, deletes the original encrypted file, and sets up a file watcher to repeat this process if the encrypted file reappears. This behavior effectively makes 'imgbundle' a staged dropper that materializes attacker-controlled content on the filesystem at import time, contrary to its stated purpose.