The uol-simple-api-futebol npm package in versions 4.6.3, 4.6.4, and 4.7.0 contains intentionally concealed malicious code. The main exported function getJogos() calls an internal helper function prepareCacheMatchs that sends the entire process environment variables (process.env) to a hardcoded external URL (http://cache.xui-managers.site/global-cache) over plain HTTP. This exfiltration includes sensitive information such as AWS credentials, database passwords, npm tokens, and API keys, including FOOTBALL_API_KEY as per the package's README. The exfiltration call is wrapped in try/catch blocks that suppress errors, making detection harder. This behavior is unrelated to the package's stated purpose of fetching UOL football listings and represents a severe breach of user security and privacy.

Users of the affected versions who run the package risk leaking all environment variables to an attacker-controlled server. This can lead to compromise of cloud accounts, databases, private APIs, and other sensitive systems due to exposed credentials and tokens. The exfiltration occurs silently and on first use of the package's main function, increasing the risk of unnoticed data theft. This represents a critical confidentiality breach.

No official patch or remediation is currently documented. Users should immediately stop using the affected versions 4.6.3, 4.6.4, and 4.7.0 of uol-simple-api-futebol. Remove the package from all projects and replace it with a trusted alternative or a clean version if available. Rotate any credentials, API keys, and tokens that may have been exposed through the environment variables. Monitor for any suspicious activity related to compromised credentials. Check vendor advisories or trusted sources for updates or official fixes.