The npm package tellyo-colours version 21.3.1 includes a runtime dependency on abbishal-poc-as-dependency with a wildcard version, allowing arbitrary code execution during installation. This dependency can fetch and run any version published by the dependency's controller, potentially executing malicious lifecycle scripts. The package is considered fully compromising any system where it is installed, requiring immediate secret and key rotation and removal of the package.