bitcoinjs-wallet version 5.4.2 is a malicious package impersonating bitcoinjs-lib. When loaded, it gathers hostname, username, home directory, platform, current working directory, and the entire process environment variables. This data is JSON-stringified, base64-encoded, and sent via an HTTPS GET request to the Telegram Bot API using a hardcoded bot token and chat ID 8969499041. A marker file in the OS temporary directory prevents repeated exfiltration. The environment variable dump can include sensitive credentials like AWS keys, NPM tokens, GitHub tokens, CI secrets, and wallet-related variables. The package tries to maintain normal functionality by re-exporting bitcoinjs-lib if installed or providing stub wallet functions, masking the malicious activity.

This malicious package can lead to the theft of sensitive environment credentials and system information from the host where it is installed. Credentials such as AWS keys, NPM tokens, GitHub tokens, and CI secrets can be exposed, potentially allowing attackers to gain unauthorized access to cloud services, code repositories, and other critical infrastructure. The exfiltration occurs silently on module load, increasing the risk of unnoticed compromise.

No official patch or fix is available since this is a malicious typosquat package rather than a vulnerability in legitimate software. The recommended mitigation is to avoid installing [email protected] and verify package names carefully before installation. Remove any instances of [email protected] from your environment. Use trusted sources and verify package integrity. Monitor for suspicious network activity related to Telegram Bot API endpoints. Since this is a malicious package, remediation involves removal and credential rotation if exposure is suspected.