The npm package javas-crypto version 2.0.4 contains malicious code that automatically exfiltrates environment variables, including sensitive credentials, to an attacker-controlled HTTP endpoint. This exfiltration occurs both during npm install via a postinstall hook and whenever the package is imported or required. The package disguises this behavior as a security feature for CI/CD pipelines, silently swallowing transmission errors to avoid detection.