The npm package vscode-test-web version 1.0.0 is a malicious package designed to cause abrupt termination of any host process that imports it by calling process.exit(0). It occupies an unscoped name similar to the legitimate @vscode/test-web package, creating a risk of name confusion. The package does not perform network communication, shell execution, or credential theft, and its metadata states it is a security-research proof-of-concept related to an MSRC bug bounty. Despite the apparent non-malicious intent, the package forcibly terminates processes, which can disrupt builds or workflows that mistakenly depend on it.