The npm package ts-ankle version 1.1.0 contains malicious code that executes automatically upon installation. It performs two hostile actions: harvesting credential files from the user's system and exfiltrating them to a remote server, and installing an SSH backdoor by injecting a public key into authorized_keys and enabling inbound SSH access. This results in full compromise of the affected system.