The npm package browserslist-db-sync versions 1.0.4 and 1.0.6 contains malicious code that uses base64 decoding to potentially hide attacker-controlled payloads. Installation or execution of this package may lead to full system compromise, requiring immediate secret and key rotation. The package should be removed, but removal alone may not eliminate all malicious artifacts.