The npm package 'radio-player-theme' version 6.0.0 contains a malicious payload in its 'payload.js' file that, when loaded in a browser, reads the origin and a specific XSRF cookie from the victim's environment and exfiltrates this data to an external domain under oastify.com. The package does not execute this code during installation but only when the JavaScript is loaded in a browser context, enabling data collection through a CSP bypass proof-of-concept. The package has no legitimate functionality beyond this data-exfiltration behavior.