The npm package 'test-nonmal-pkg-5' version 1.0.1 contains malicious code that exfiltrates environment variables by sending them via an obfuscated HTTP POST request upon import. The exfiltration target is currently a loopback address, preventing data leakage in normal environments, but the code is designed to be easily modified to target external hosts. The package also includes deceptive comments and user-agent strings intended to mislead automated security reviewers. Installation of this package compromises the host, potentially exposing all stored secrets and keys.