The electron-orbit npm package contains malicious code that activates when required in Node.js environments. It establishes a covert network connection using a custom TLS 1.3 implementation to an Azure blob storage endpoint, bypassing standard TLS interception and static inspection. The package collects environment variables related to PATH and the current working directory, sending this data encoded in the request URL to the attacker-controlled server. Activation is conditional, triggered only when a specific environment variable's SHA-256 hash matches a hardcoded value, allowing targeted execution in chosen environments such as CI pipelines. The package's advertised functionality is a pretext; it does not perform legitimate icon fetching or SVG rendering as claimed.