The npm package 'warp-dependency' version 1.0.0 contains malicious code that executes a heavily obfuscated script during installation. This script downloads and runs an unsigned Windows executable from an anonymous ephemeral tunneling service, unrelated to the package's stated purpose. The package name is a typosquat of the legitimate 'warp' brand. Installing this package results in silent execution of attacker-controlled native code, potentially compromising the entire system. Removal of the package does not guarantee elimination of all malicious components, and any secrets or keys on the affected system should be rotated immediately.