The npm package 'webpack-cache-cycle' version 0.1.4 contains malicious code that executes attacker-controlled JavaScript during installation. It uses a postinstall script to spawn a detached process that fetches and runs code from an obfuscated, anonymous URL. This behavior is unexpected for a webpack cache plugin and indicates a supply chain compromise. Systems with this package installed should be considered fully compromised, and all secrets on those systems must be rotated immediately.