The npm package 'analysis-chart' contains a malicious postinstall script that downloads and executes attacker-controlled native code on Windows developer machines. The payload is XOR-decrypted and injected into memory, then executed. After execution, the script attempts to remove evidence by deleting files and removing the package from the host project. The package's API is a decoy, and author metadata appears fabricated.