The npm package birch-css-utils, advertised as a zero-runtime CSS theme kit for Tailwind, contains heavily obfuscated JavaScript code that executes on import. This code includes AWS Sigv4 signing primitives and AWS Access Key ID patterns, indicating it is designed to steal AWS credentials from users who import the package. The package's README falsely denies runtime JavaScript, misleading users. Installation or use of this package can lead to full system compromise and credential theft.