The npm package 'crypto-javas' contains malicious code that harvests environment variables and CI metadata, then exfiltrates this data to an attacker-controlled backend. This behavior occurs both during the postinstall hook and every time the package is imported or required. The package masquerades as '@wizlabs/js-crypto' but is a typosquat with a placeholder repository and generic author information. This leads to exposure of sensitive CI secrets such as AWS credentials, GitHub tokens, and other pipeline secrets. The affected versions are 2.0.4, 2.0.7, and 2.0.8. No official patch or remediation is currently documented.