The fhirproxy npm package version 90.0.0 is a malicious package that impersonates OpenMRS tooling and executes attacker-controlled code during installation and on every invocation of common developer tools. It hijacks the names of widely used tools such as webpack, eslint, and jest, causing them to run malicious code instead of the legitimate tools. This results in full compromise of any computer where the package is installed or running.