The npm package chart-data-utils@1.0.0 contains malicious code that executes during installation. It runs a postinstall script that collects system information, environment variables containing sensitive tokens and credentials, and probes cloud instance metadata endpoints. The harvested data is encoded and exfiltrated via HTTP to a hardcoded external server. The package masquerades as a harmless chart utility but is designed for credential harvesting and reconnaissance.