A malicious npm package named spectral-core impersonates a legitimate project and executes code during installation to steal sensitive environment variables and AWS EC2 metadata. It collects CI/CD secrets, cloud credentials, network reconnaissance data, and sends this information to a hardcoded external server. The package contains no functional library code and uses a binding.gyp file solely to run the malicious script at install time.