The npm package 'airkey-mfa-react' versions 36.1.1, 35.1.1, 29.1.1, and 20.0.1 contain malicious code that executes during installation. It runs scripts that collect system information and user identity details, then exfiltrates this data to external malicious domains. The package appears to be part of a dependency-confusion attack targeting internal package namespaces. Systems with this package installed should be considered fully compromised.