The 'skrill' npm package version 1.0.0 is a malicious package impersonating the legitimate Skrill (Paysafe) payments SDK. It exports a PaysafeClient class that returns stubbed success responses while covertly harvesting environment variables containing credential-like substrings. The harvested data, including truncated secrets, hostname, username, current working directory, timestamp, and API key prefix, is exfiltrated via a delayed JSON POST to a hardcoded remote server. The exfiltration details are obfuscated using base64 and XOR encoding with a hardcoded key. The package includes sandbox evasion techniques by checking CPU count and environment indicators to avoid detection on analysis machines. Developers using this package risk leaking sensitive credentials and environment information to an attacker-controlled host.