The npm package js-price-client-node version 1.0.0 contains malicious code that exfiltrates environment variables from the user's .env file during installation. The package's postinstall script reads and parses the .env file, then sends the data to a concealed remote server using a base58-encoded URL split across two files. The exfiltration is stealthy, with errors suppressed and fake success responses returned to avoid detection. The package falsely claims to fetch cryptocurrency prices but performs no such function, instead harvesting sensitive credentials such as API keys and passwords.