The npm package @epic-common/observability-node versions 10.10.1 and 10.10.2 contains malicious code that exfiltrates environment variable names and metadata, as well as credential fingerprints, to an external endpoint. It masquerades as a legitimate OpenTelemetry API re-export to avoid detection. This results in unauthorized disclosure of sensitive environment information and credential-related data from the host machine.