The spl-token-utils package (version 1.4.2) is a malicious npm package designed as a typosquat of @solana/spl-token. When required, it serializes the full process environment variables plus hostname, username, home directory, platform, current working directory, and package metadata. This data is base64-encoded and sent via an HTTPS GET request to a Telegram bot endpoint with a hardcoded chat ID. To avoid repeated exfiltration, it creates a marker file in the OS temporary directory. It then requires and re-exports the legitimate @solana/spl-token package to appear functional to consumers. This exfiltration captures sensitive environment credentials such as cloud keys, CI tokens, and database URLs, which are unrelated to any legitimate SPL/Solana utility function.

Sensitive environment variables and system metadata, including potentially critical credentials like cloud keys, CI/publish tokens, and database URLs, are exfiltrated to an attacker-controlled Telegram bot endpoint. This can lead to unauthorized access to cloud resources, continuous integration pipelines, databases, and other sensitive infrastructure components. The malicious package's design to appear functional while exfiltrating data increases the risk of unnoticed compromise in environments where it is installed.

Avoid installing the spl-token-utils package, especially version 1.4.2, as it is a known malicious typosquat. Verify package names carefully before installation to prevent accidental use of typosquat packages. Remove any instances of spl-token-utils from your environment immediately. Since no official fix or patch is available, remediation involves uninstalling the malicious package and auditing environment credentials for potential compromise. Rotate any exposed credentials and secrets that may have been present in the environment at the time of installation.