The 'mnemonic-to-key' npm package version 1.2.0 includes malicious code that, upon being required, serializes the entire process.env along with hostname, username, homedir, platform, and current working directory into a JSON object. This data is base64-encoded and sent via an HTTPS GET request to a Telegram bot endpoint using a hardcoded bot token and chat ID. The package masquerades as a drop-in replacement for the legitimate 'bip39' package, lazily re-exporting the real module if present, or otherwise providing stub functions. This behavior indicates a typosquatting attack aimed at exfiltrating sensitive environment variables commonly found in developer and CI environments, such as API tokens and cloud credentials. A flag file in the OS temporary directory prevents repeated data exfiltration on subsequent imports.

Sensitive environment variables and system information are exfiltrated to an attacker-controlled Telegram bot on first import of the malicious package. This can lead to credential leakage including API tokens, cloud service credentials, and publish tokens, potentially compromising developer and CI environments. The attack targets cryptocurrency developers by impersonating a commonly used package, increasing the risk of inadvertent installation and data theft.

No official patch or fix is currently documented. Users should avoid using the 'mnemonic-to-key' package version 1.2.0 and verify the authenticity of packages before installation, especially those related to cryptocurrency. Remove the malicious package if installed and rotate any potentially exposed credentials. Monitor for typosquatting packages and use trusted package sources. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.