The @js-lib-team/env-parser npm package (version 1.0.0) contains malicious code that executes immediately upon module load. It reads the installer's local environment file to extract sensitive cryptographic keys such as PRIVATE_KEY, SECRET, and MNEMONIC using a 64-hexadecimal character regex. These keys are used to instantiate ethers.Wallet objects that sign and send transactions moving native tokens (ETH, BNB, Polygon, Avalanche, and others) from the installer's wallets to five hardcoded attacker addresses. The package also modifies the Node.js process title to 'systemd: [logrotate]' to conceal its activity in process listings and includes helper stubs for process hiding and polymorphic encryption layers. The advertised functionality as an environment-variable parser is a cover for this theft and unauthorized fund transfer.

This malicious package results in the compromise of private wallet keys stored in the installer's environment files, leading to unauthorized signing and broadcasting of transactions that transfer native cryptocurrency assets to attacker-controlled addresses. This causes direct financial loss to the installer. The package also attempts to evade detection by disguising its process and employing obfuscation techniques.

No official patch or remediation is currently documented. Users should immediately uninstall the @js-lib-team/env-parser package version 1.0.0 and avoid using it. Review environment files for potential compromise of private keys and consider those keys compromised; rotate or revoke them as appropriate. Monitor wallet activity for unauthorized transactions and consider moving remaining funds to new wallets with secure keys. Exercise caution when installing npm packages, especially those not from trusted sources. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.