The @krentzen/buffer-reverse npm package version 1.0.3 is a malicious package impersonating a legitimate utility. It contains heavily obfuscated code that executes at import time, detaching a child Node process which downloads and executes an attacker-controlled binary from the internet. This binary is unsigned and unverified, allowing execution of arbitrary native code on the host system. Any project requiring this package will run this malicious code, potentially compromising the environment.