The npm package express-mocha-test version 0.0.1 contains malicious code that executes attacker-controlled JavaScript during installation. It uses a postinstall lifecycle hook to fetch code from an attacker-controlled ngrok-free.app tunnel and evaluates it directly, leading to remote code execution on any machine running npm install for this package. The package metadata impersonates known maintainers to deceive users. This results in full system compromise, requiring immediate secret and key rotation and package removal.