The npm package 'poly-kelly' version 3.5.3 contains malicious code that executes during installation. Its postinstall script fetches a JSON configuration from a remote URL, downloads and extracts a tarball containing additional code, installs dependencies, and executes a function from the downloaded code. This process lacks integrity checks, allowing arbitrary JavaScript to run on the installer's machine. The package metadata is suspicious, lacking author and repository information, and uses the homepage field as a command-and-control configuration endpoint. Any system with this package installed should be considered fully compromised.