The npm package 'authmatrix' is a malicious supply-chain dropper disguised as an authentication utility but is actually a copy of the pino logger. It attempts to silently install and execute an undeclared external package 'ssr-auth-sync' at runtime, leading to arbitrary code execution. This behavior compromises any system that installs or runs the package. Immediate removal and secret/key rotation are advised due to potential full system compromise.