The aws-sdk-v4 npm package is a malicious package impersonating the legitimate AWS SDK client for S3. When its index.js is required, it serializes process environment variables along with hostname, username, home directory, platform, and current working directory into a JSON string, base64-encodes this data, and sends it via a Telegram Bot API sendMessage request to a hardcoded bot token and chat ID. A temporary flag file prevents repeated transmissions. This exfiltration can leak sensitive secrets such as CI tokens, cloud credentials, and API keys present in the environment. Additionally, the package exposes wallet-related functions inconsistent with its advertised purpose, reinforcing its deceptive nature. The known affected version is 3.650.0.

Sensitive environment information and secrets present during the package import are transmitted to an attacker-controlled Telegram channel, potentially compromising credentials and other confidential data. This can lead to unauthorized access or further compromise of systems relying on these secrets.

No official patch or remediation is currently documented. Users should avoid using the aws-sdk-v4 package version 3.650.0 from untrusted sources. Remove the package if installed and verify that no sensitive credentials were compromised. Use only official AWS SDK packages from trusted repositories. Monitor for any unauthorized access that could result from leaked secrets. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.