The npm package @postex/common version 99.9.1 contains a malicious dependency that fetches and executes attacker-controlled code from an off-registry URL. Installing this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.