The npm package @ferudionz/web_logger_js version 1.0.0 contains obfuscated malicious code that exfiltrates data to an author-controlled endpoint. The package exports a function that sends its input to a hidden URL assembled at runtime, likely targeting EVM/crypto account identifiers or keys. The obfuscation includes RC4 decoding, anti-debug wrappers, and runtime string reconstruction to conceal the network destination. This behavior is not documented and indicates intentional data theft rather than a legitimate service call.