The 'skrill-payments' npm package version 1.0.0 is a malicious package impersonating a legitimate Paysafe/Skrill payments SDK. It provides fake API methods that return mock success responses but secretly exfiltrate sensitive environment variables containing credentials and system information to a hardcoded remote server. The package uses obfuscation techniques and sandbox evasion to avoid detection, targeting developer workstations that install or use it.