The ethereum-kit-1 npm package version 1.0.0 includes malicious postinstall scripts that automatically execute upon installation. These scripts harvest sensitive data from the user's environment, including SSH private keys (~/.ssh/id_rsa), cryptocurrency wallet keys and seeds, and environment variables. The stolen information is sent to a Telegram bot with a fixed identifier, indicating targeted data exfiltration. This package is linked to a broader campaign involving crypto and blockchain-related malicious packages. No CVSS score is assigned, and no official patch or remediation guidance is provided.

Compromise of sensitive cryptographic credentials and environment variables can lead to unauthorized access to SSH servers, cryptocurrency wallets, and potentially other systems. The exfiltration of this data to a Telegram bot controlled by the attacker enables theft of digital assets and further compromise of affected systems.

No official patch or remediation is currently documented. Users should avoid installing ethereum-kit-1 version 1.0.0 and remove it if already installed. Review and rotate any potentially compromised SSH keys, wallet keys, seeds, and environment variables. Monitor for suspicious activity related to these credentials. Since this is a malicious package, the best mitigation is to avoid using it and rely on trusted sources for dependencies.