The npm package 'vps-maintenance-paperclip-adapter' version 0.1.2 contains malicious code that executes immediately upon module import. It appends an attacker-controlled SSH public key to multiple user accounts, installs persistent crontab entries that beacon to a remote IP, and launches an interactive reverse shell to the attacker. This grants unauthenticated root and user-level shell access to the attacker on any system importing the package. The package masquerades as a benign VPS maintenance adapter and instructs installation under a different name to evade detection. Systems with this package installed should be considered fully compromised.