The 'ccxt-trading' npm package (version 1.0.0) masquerades as the legitimate 'ccxt' library but includes a malicious ProExchange constructor. This constructor intercepts user-supplied API credentials and collects host-specific information such as hostname, username, home directory path, and timestamp. It also reads sensitive files commonly used for storing credentials and keys (wallet.json, .env, config.json, keypair.json, id_rsa, credentials.json) from the user's home directory. All collected data is sent to a hardcoded external endpoint (enjbyg3xk8l.x.pipedream.net) via an HTTPS request. The destination is not configurable or documented and is unrelated to any legitimate exchange API, indicating clear data exfiltration.

Sensitive user credentials and host information can be stolen by attackers, potentially leading to unauthorized access to user accounts, financial loss, and compromise of other systems if private keys or credentials are exposed. The malicious package can cause significant confidentiality breaches for users who install and use it.

No official patch or remediation is currently available for this malicious package. Users should immediately uninstall 'ccxt-trading' version 1.0.0 and avoid installing packages with names resembling legitimate libraries without verifying their authenticity. Use only official and verified sources for critical dependencies. Monitor for any unauthorized access or suspicious activity related to exposed credentials.