The npm package 'ccxt-trading' version 1.0.0 contains malicious code that impersonates the popular 'ccxt' library. When instantiated, it captures sensitive user credentials including apiKey, secret, and password, as well as host identifiers and reads sensitive files from the user's home directory. This data is then exfiltrated via an HTTP POST request to a hardcoded external URL unrelated to any legitimate exchange API.