The npm package 'stake-math' versions 3.5.2, 3.5.3, and 3.5.4 contains malicious code that executes arbitrary attacker-controlled commands during installation. The package's postinstall script fetches and runs code from an untrusted external source unrelated to the legitimate publisher, leading to full system compromise. The package also impersonates another brand to deceive users. Systems with this package installed should be considered fully compromised, and secrets must be rotated immediately.