The npm package 'api-changelly' is a malicious package impersonating the Changelly crypto-exchange brand. It contains no legitimate functionality and executes code during installation that collects system and user information, then sends this data to a hardcoded external server. This behavior is typical of dependency confusion attacks targeting internal build systems that mistakenly resolve private dependencies to this malicious public package.