The @merceas/cross-fetch npm package version 3.1.12 is a malicious package impersonating the legitimate cross-fetch library. It contains obfuscated code that, when imported, downloads and executes attacker-controlled payloads on the host machine. This execution occurs in any environment that loads the module, including CI, build, production, or developer workstations, enabling remote code execution and persistence.