The npm package crypto-validates@0.0.2 contains malicious code that exfiltrates data by base64-encoding input to its validate function and sending it, along with random bytes generated by crypto.randomBytes, to a remote server. The package does not execute code on install or import, but performs data exfiltration on the first function call. It is published by the same author as other suspicious packages. Systems with this package installed should be considered fully compromised.