web3-utils-crypto is a malicious npm package that masquerades as a drop-in replacement for the legitimate web3-utils library. It provides stub implementations of wallet-related APIs that do not function correctly. Upon being required, the package serializes the full process environment variables along with system information such as hostname, username, home directory, platform, current working directory, package name/version, and a timestamp. This data is base64-encoded and sent via an HTTPS GET request to a Telegram bot endpoint controlled by the attacker. Because process.env often contains sensitive credentials in developer and CI environments, this results in the exfiltration of secrets to an attacker-controlled Telegram chat. A temporary flag file is used to suppress repeated transmissions. The only known affected version is 1.10.4.

Sensitive environment variables and system information, including credentials like AWS keys, GitHub tokens, NPM tokens, and database passwords, can be exfiltrated to an attacker-controlled Telegram chat. This compromises the confidentiality of secrets in developer and continuous integration environments that install and load this package. The malicious code effectively leaks critical secrets, potentially enabling further compromise of systems and services.

No official patch or remediation is currently documented. Users should immediately remove and avoid installing the web3-utils-crypto package, especially version 1.10.4. Verify dependencies to ensure this malicious package is not included transitively. Rotate any credentials that may have been exposed if this package was installed and loaded in your environment. Monitor for suspicious network traffic to Telegram endpoints. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.