The npm package 'skrill-sdk' version 1.0.0 is a malicious package impersonating an official Skrill/Paysafe SDK. It exposes a fake PaysafeClient API that returns stubbed success responses but schedules delayed exfiltration of sensitive data including machine hostname, username, working directory, credential-like environment variables, and partial API keys. The stolen data is sent over HTTPS to a hardcoded remote server. The package uses obfuscation techniques to hide its command and control details and avoids exfiltration in sandbox or analysis environments. This threat targets developers or CI systems using the package with real credentials.