The npm package 'eslint-commit-parser' version 1.0.0 is a malicious package that impersonates a legitimate tool but contains unrelated code copied from the 'supertest' HTTP-testing library. It includes a deceptive package.json and drags in an unused dependency 'express-mocha-test@^0.0.1'. The package communicates with a domain associated with malicious activity and installing it may fully compromise the host system.