The 'crypto-javas' npm package includes a postinstall script that executes setup.js, which collects nearly all environment variables except a small OS blocklist, along with CI job metadata like CI_JOB_ID, GITHUB_RUN_ID, project, commit, branch, and hostname. This data is sent via HTTPS POST to a backend URL and API key configurable through environment variables or configuration files. Additionally, the main entrypoint index.js calls autoExecute() at the module top level, causing the environment variable harvesting and exfiltration to occur on every import or require of the package. The package is presented misleadingly as '@wizlabs/js-crypto' but is a typosquat with a placeholder repository and a generic author handle, indicating malicious intent. This results in the leakage of sensitive CI/CD secrets including AWS credentials, GitHub tokens, NPM tokens, and CI job tokens to an attacker-controlled server.

Exposure of sensitive environment variables and CI/CD pipeline secrets to an attacker-controlled backend can lead to unauthorized access to cloud resources, source code repositories, and package registries. This compromises the confidentiality and integrity of the development and deployment environment, potentially enabling further attacks or data breaches.

No official patch or remediation is currently documented for this malicious package. Users should immediately remove 'crypto-javas' versions 2.0.4, 2.0.7, and 2.0.8 from their projects and replace them with trusted alternatives. Audit CI/CD pipelines and environment variables for potential exposure. Avoid using packages with suspicious repository URLs, generic author information, or typosquat names. Monitor for any unauthorized access using leaked credentials and rotate secrets if compromise is suspected.