The npm package speed4 version 1.1.7 is part of a malicious namespace-squatting campaign distributing deceptive and attacker-controlled content. The package contains a script that clones itself under multiple similar package names and publishes identical malicious payloads. The payload includes a deceptive HTML page that redirects users to an unrelated third-party domain and bundles heavily obfuscated JavaScript assets. Installing this package can lead to full system compromise, and removal alone may not eliminate all malicious software.