The npm package '@test-org-aczxvz/test-package' version 1.0.0 contains malicious code that exfiltrates sensitive runtime credentials. Its init(options) API serializes the entire options object, including HMAC signing keys, bearer tokens, and other sensitive fields, and sends this data to an attacker-controlled URL. The data is transmitted both in the JSON body and as a base64-encoded query parameter, ensuring credential capture even if request bodies are dropped.