The npm package 'path-extend' is a malicious typosquatting package that mimics Node.js's built-in 'path' module. It injects code that fetches attacker-controlled JavaScript from an anonymous JSON paste service and executes it via eval(), allowing dynamic remote code execution. Installing or requiring this package results in running arbitrary code controlled by the attacker, potentially compromising the entire system and exposing all stored secrets and keys.