Malicious npm package. dist/index.js hides a dropper behind base64: it spawns 'npm install cors-version --no-save --silent --no-audit --no-fund' via child_process and then require()s the 'cors-version' package to execute it. Both the command and the module name are base64-encoded and the install flags suppress output/audit. Version 0.13.2 swapped the second-stage package from 'cors-update' to 'cors-version'. The cors-version payload is an external package fetched at runtime and is not shipped here. Confirmed malicious: obfuscated dropper that silently installs and executes untrusted external code.