The npm package @hotcappuccino/nodepull versions 1.0.0 and 1.0.1 contains malicious code that executes automatically upon import. It uses obfuscation and encryption to hide its behavior, which involves downloading a remote binary and executing it silently on the host system. This results in full compromise of any system where the package is installed or run.