The npm package 'ac-element-engagement' version 3.0.1 and 99.9.9 contains malicious code. It has been identified as malicious because it communicates with domains linked to malicious activity and executes commands associated with malicious behavior. There is no CVSS score available for this threat.