The npm package 'nemo-jaws' contains malicious code that executes during installation. Its preinstall script collects various host system identifiers and sends them to an external attacker-controlled server. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems should be rotated immediately. Removal of the package does not guarantee complete remediation due to potential persistent compromise.