The malicious packages contained scripts capable of stealing credentials from web browsers, downloading additional harmful scripts, and establishing connections to known North Korean threat actors.