The npm package uol-simple-api-futebol versions 4.6.3, 4.6.4, and 4.7.0 contains malicious code that exfiltrates the entire environment variables of the host process to an attacker-controlled server via an unencrypted HTTP POST request. This includes sensitive credentials such as cloud keys, database passwords, API tokens, and other secrets. The exfiltration is concealed within a misleadingly named internal function and errors during this process are silently ignored, increasing the risk of unnoticed data leakage.