The npm package react-next-dom is a malicious package masquerading as a legitimate React/Next.js ecosystem library. It contains a hidden remote code loader that fetches and executes attacker-controlled JavaScript code with full Node.js require access, enabling arbitrary code execution. The package uses a detached child process to load payloads from an anonymous public paste service, allowing the attacker to modify the executed code at will. This compromises any system that installs or runs the package, potentially exposing all stored secrets and keys. Immediate removal and secret rotation are strongly recommended.