The npm package @digitalcnzz/embedded-sdk is identified as purpose-built malware that exfiltrates host information and environment secrets during installation. It operates as a postinstall hook, collecting sensitive data such as hostname, username, platform, Node version, IP addresses, and environment variables, which may include tokens and keys. The stolen data is sent to an attacker-controlled Feishu/Lark webhook endpoint using obfuscated communication methods. The malware includes extensive anti-analysis features to evade detection in sandbox and honeypot environments.