The crypto-utils-7 npm package at version 1.0.0 includes malicious postinstall scripts that automatically execute upon installation. These scripts collect sensitive cryptographic credentials including SSH private keys, wallet keys, seeds, and environment variables from the victim's environment. The harvested data is then sent to a Telegram bot controlled by the attacker. The package is identified as a crypto stealer and is related to a broader campaign involving other malicious packages with similar naming conventions and version patterns. This threat was detected by Amazon Inspector and is cataloged under MAL-2026-5353 in the GCVE database.

Exposure of private SSH keys, cryptocurrency wallet keys, seeds, and environment variables can lead to unauthorized access to systems and cryptocurrency assets. The attacker gains the ability to compromise victim environments and potentially steal funds or sensitive information. The fixed Telegram bot endpoint indicates a centralized exfiltration point, which could be used to track or disrupt the attack if identified.

No official patch or remediation is currently available for this malicious package. Users should avoid installing crypto-utils-7 version 1.0.0 and remove it if already present. Verify dependencies and audit installed npm packages for malicious code. Use trusted package sources and consider implementing supply chain security measures such as package signing and integrity verification.