[email protected] is a malicious npm package designed to masquerade as a Docker API client but instead performs credential theft. Upon being imported, it gathers detailed system and environment data, including sensitive credentials commonly found in environment variables. This information is encoded and sent to an attacker-controlled Telegram chat via a hardcoded bot token and chat ID. The presence of wallet-related functions unrelated to Docker confirms the package's deceptive nature. This represents a supply chain compromise risk through typosquatting, where developers mistakenly install this package instead of the legitimate dockerode client.

Any process that imports [email protected] leaks its full environment, including sensitive credentials such as AWS keys, GitHub tokens, NPM tokens, and database secrets, to an attacker-controlled Telegram chat. This can lead to unauthorized access to cloud services, source code repositories, package registries, and databases, severely compromising the security of affected systems and organizations.

No official patch or remediation is available for this malicious package. The recommended mitigation is to avoid installing or using [email protected] and instead use the legitimate dockerode package. Developers and organizations should audit their dependencies for typosquatting and malicious packages, remove docker-api-client if present, and rotate any potentially exposed credentials. Monitoring package sources and using trusted package registries with supply chain security measures can help prevent such incidents.