The npm package fabric-render-bridge (version 1.0.0) contains malicious code that executes automatically upon installation. Instead of providing rendering functionality, it steals Minecraft launcher credentials and system information, sending them to a hardcoded Discord webhook. This behavior occurs during the post-install script execution, compromising user credentials and host identity.