The npm package 'ripshakti' version 80.0.0 contains malicious code that executes automatically during installation. Its preinstall script collects sensitive AWS instance metadata, environment secrets, and IAM credentials, then exfiltrates this data to an attacker-controlled server. This compromises cloud IAM roles and environment secrets of any system running 'npm install' for this package.