The npm package fabric-native-loader version 1.0.0 contains malicious code that executes during installation. It steals Minecraft launcher credentials and related tokens from various launcher files and system information, then sends this data to a hardcoded Discord webhook. The package does not provide any legitimate functionality matching its name and solely acts to exfiltrate sensitive user credentials.