The npm package @tekmidian/pai versions 1.0.8, 1.0.9, and 1.0.10 contains malicious code. Although the codebase includes references to shell commands and base64 decoding, no direct evidence links these to active exfiltration or execution flows. However, the package is flagged as malware by a security source, indicating that any system with this package installed should be considered fully compromised. Immediate removal and secret/key rotation are recommended.