The npm package 'pathfix' versions 3.0.10, 3.0.11, and 3.0.12 contains malicious code that executes remote code on the installer's machine. It masquerades as a Stylus port of normalize.css but includes a backdoor that fetches and evaluates JavaScript from a remote URL with full require access. This leads to full system compromise upon installation or use. Immediate removal and secret/key rotation are strongly advised.