The npm package 'ref-slot' version 1.0.9 contains malicious code executed during installation. It harvests sensitive files from the user's system, uploads them to an attacker-controlled server, installs a persistent SSH backdoor on Linux systems with passwordless sudo, and dynamically updates its targeting patterns from a remote server. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately.