The npm package poc-ch4rlygr contains malicious code that exfiltrates sensitive environment information upon import or require. It collects system details and environment variables, including secrets such as AWS, NPM, GitHub, and CI tokens, and sends them via HTTPS GET to a hardcoded external endpoint. The package also declares a postinstall script that is not included in the tarball, indicating the import-time code is the main exfiltration vector.