The npm package 'ripshakti1' version 81.0.0 contains malicious code that executes automatically during installation. It collects sensitive AWS metadata and environment variables that may contain secrets, encodes this data, and exfiltrates it to an attacker-controlled domain. This behavior occurs on every install, including transitive dependencies and CI environments.