The npm package @osmura/treeify versions 1.1.0, 1.1.2, and 1.1.3 contains malicious code appended to the legitimate treeify library code. This injected code executes upon requiring the package, spawning a detached Node.js process that fetches and decrypts attacker-controlled payloads from remote servers, then executes them on the victim's machine. The malicious code uses obfuscation techniques and fallback command-and-control URLs to ensure persistence and stealth. This results in arbitrary code execution on any system importing this package version.