The npm package @pkgship/frpc-darwin-amd64 version 0.71.1 contains malicious code. This package ships a prebuilt binary for the darwin-amd64 platform. Although no install-time scripts, network callbacks, credential reads, or obfuscated code were identified in the shipped contents, the package is considered fully compromising to any system where it is installed or running. Immediate removal of the package and rotation of all secrets and keys from a different, uncompromised computer is strongly advised.