The npm package axios-fast versions 1.0.0 and 1.0.1 contains malicious code that executes during installation. Specifically, a preinstall script sends all environment variables from the installing machine to an attacker-controlled webhook URL. This can expose sensitive secrets such as AWS credentials, NPM tokens, and GitHub tokens. The package is a typosquat of the popular axios HTTP client and does not provide legitimate functionality beyond this exfiltration.