It's a npm package with no actual source that does anything, but there's a prebuild file that is an exe containing malware