The js-price-client-node npm package (version 1.0.0) includes a postinstall script that executes a function named prices() which determines the project root directory, reads the .env file, parses it using dotenv, and sends the parsed key-value pairs as JSON to a remote URL. The destination URL is obfuscated by base58 encoding and split between two source files, then decoded at runtime. The upload operation suppresses errors to avoid alerting the user. The package metadata and README are deceptive, copying content from unrelated packages to disguise its true intent. This behavior constitutes credential exfiltration from the user's environment during package installation.

Sensitive environment variables stored in .env files, which often include API keys, database passwords, cloud credentials, and signing secrets, are silently exfiltrated to an attacker-controlled server during installation of the affected package version. This can lead to compromise of user accounts, cloud resources, and other systems relying on these credentials.

No official patch or remediation is currently available for this malicious package. Users should avoid installing js-price-client-node version 1.0.0. Review and remove this package from any projects where it has been installed. Rotate any credentials that may have been exposed through .env files used in conjunction with this package. Monitor for suspicious activity related to compromised credentials. Always verify the authenticity and reputation of npm packages before installation.