The npm package @gbrlxvi/ts-form-utils contains malicious code that executes a hidden, encrypted payload when imported in certain sandbox or AI-agent environments. It detects specific host signals and silently decrypts and runs attacker-controlled code with full host process privileges. This behavior is designed to evade detection and targets CI/sandbox environments while appearing benign on developer machines. Any system with this package installed should be considered fully compromised.