The npm package 'kecak256' is a typosquatting malicious package impersonating the legitimate 'keccak256' package by dropping one 'c' in the name. It includes a credential-stealing payload that executes automatically upon installation. The package uses obfuscated scripts to spawn hidden processes that collect browser and credential store data, archive it, and exfiltrate it in chunks to a command-and-control server. The package author field is also impersonated to match the legitimate maintainer. Multiple versions of this package are affected. Any system with this package installed should be considered compromised, and secrets should be rotated immediately.