The bip39-generator package (version 3.1.2) is a malicious npm package designed to steal sensitive information from the environment of any process that loads it. Upon loading, its index.js serializes the entire process environment variables along with host details such as hostname, username, home directory, platform, and current working directory. This data is base64-encoded and sent via an HTTPS GET request to a Telegram bot API endpoint using a hardcoded bot token and chat ID. The package exports stub functions that do not perform legitimate wallet or mnemonic operations, indicating it is a typosquatting lure targeting crypto developers. A temporary directory marker file prevents repeated data exfiltration attempts. This behavior results in leakage of potentially sensitive secrets and host identity to the attacker-controlled Telegram channel.

Any process that installs and requires bip39-generator version 3.1.2 will leak its full environment variables and host identity information to an attacker-controlled Telegram channel. This can include API keys, cloud credentials, continuous integration secrets, and other sensitive data present in environment variables. The package does not perform legitimate cryptographic functions, so any dependent software relying on it will not function correctly, potentially causing operational issues in addition to data exposure.

No official patch or remediation is indicated for bip39-generator version 3.1.2. Users should immediately remove this malicious package from their projects and replace it with the legitimate bip39 package. Audit dependencies to detect and eliminate typosquatting or malicious packages. Avoid using untrusted or unknown packages, especially those mimicking popular libraries. Monitor for any unauthorized access or credential misuse resulting from the exposure.