The npm package 'rpc-endpoint-rotator' version 1.0.0 contains malicious code that, upon being required, unconditionally sends a POST request to an external URL. This request transmits the entire process environment variables along with OS hostname, username, and home directory information. The malicious behavior is hidden behind legitimate-looking exported helpers, and the code is described as a hidden periodic environment data beacon. This exfiltration can leak sensitive credentials such as cloud keys, CI tokens, and provider secrets present in the environment.