The npm package spectral-net-probe contains malicious code in versions 1.0.1, 1.0.4, and 1.0.10. These versions execute code during installation or loading that contacts remote servers to exfiltrate local files specified by the attacker. This behavior constitutes a supply-chain attack leveraging npm package distribution to steal arbitrary files from users' systems.