The 'test-nonmal-pkg-5' npm package version 1.0.1 includes an obfuscated payload that, when imported, enumerates all environment variables and sends them as JSON to a specified HTTP endpoint. Although the current endpoint is a local loopback address (127.0.0.1:4000), the obfuscation and code structure indicate intent to exfiltrate sensitive data. The package contains explicit hostile indicators such as misleading comments and a crafted HTTP User-Agent string to evade detection. This behavior constitutes an active attack vector, compromising any system where the package is installed or executed.

Any system with this package installed or running is considered fully compromised. All secrets and keys accessible via environment variables may be exposed. Because the package executes code on import that sends environment data externally, attackers could gain unauthorized access to sensitive information. Removal of the package does not guarantee full remediation, as the attacker may have established persistent control or installed additional malicious software.

No official patch or fix is available for this malicious package. Immediate removal of 'test-nonmal-pkg-5' version 1.0.1 is strongly recommended. All secrets and keys stored on the compromised system should be rotated from a separate, trusted environment. Treat any system with this package as fully compromised and conduct a thorough security assessment to identify and remove any additional malicious artifacts.