The npm package 'js-client-node' version 1.4.0 contains malicious code that exfiltrates environment variables from the installer's project during installation. It uses a postinstall hook to read the .env file at the project root and sends all environment variables, including sensitive data like API keys and credentials, to a remote server. The package disguises itself as a legitimate crypto price fetcher, with a misleading README and package metadata. This results in silent leakage of sensitive information upon installation.