The npm package 'self-certificate' versions 1.0.0 and 1.1.0 contains malicious code disguised as a self-signed certificate generator. Its generateCertificates() API loads a fake PEM file that is actually a base64-encoded JavaScript payload. This payload fetches a concealed command-and-control URL and executes the retrieved data via a detached, hidden Python process, creating a remote code execution backdoor for any user invoking the API.