The npm package 'utils-mf' contains malicious code that executes immediately upon import. It includes a hidden WhatsApp bot that collects user credentials, periodically exfiltrates local chat and session data to attacker-controlled GitHub and GitLab repositories, silently self-updates by overwriting its own code from the npm registry, and executes privileged system commands to install software and manipulate system files. This behavior constitutes an active supply-chain attack that compromises any system installing this package. Removal of the package does not guarantee full remediation due to potential persistent compromise.