Malicious npm packages impersonating a legitimate ordered-map library. The payload is embedded in the library's runtime API rather than an install script, so it executes when a consuming application calls the affected method instead of at install time, then collects host information and retrieves further instructions from an external service. All affected packages have been removed from the npm registry.