The npm package 'package-uploader' version 1.3.25 contains malicious code that executes automatically during installation. It drops and runs an obfuscated Windows executable payload, then attempts to remove traces by editing package files and deleting its own directory. The package's declared functionality is a decoy unrelated to the malicious behavior. This supply-chain dropper compromises any system where it is installed, potentially giving full control to attackers.