The npm package 'permit2' is a malicious package impersonating Uniswap's Permit2 token-approval system. It contains no legitimate functionality but executes a payload during installation that steals sensitive environment variables and credential files from the host. The stolen data is exfiltrated to an attacker-controlled endpoint. Hosts that installed this package should consider all exposed credentials compromised and rotate them immediately.