The @zzzcrypto/bitcoin-lib npm package (version 6.1.7) includes code that, upon being required, serializes process environment variables along with host details such as hostname, username, home directory, platform, current working directory, and a timestamp. This data is base64-encoded and sent via an HTTPS GET request to api.telegram.org using a hardcoded bot token and chat_id. A temporary flag file limits repeated exfiltration to reduce noise. The package attempts to require the legitimate bitcoinjs-lib to proxy its API, maintaining normal behavior for callers and evading suspicion. Internal identifiers in the exfiltration code are obfuscated. Because environment variables in development and CI environments often contain sensitive credentials, this behavior constitutes credential and host-identity theft for any process importing this package.

Any process importing @zzzcrypto/bitcoin-lib version 6.1.7 risks leaking sensitive environment variables and host identity information to an attacker-controlled Telegram endpoint. This can lead to compromise of credentials, API tokens, cloud keys, and other secrets stored in environment variables, potentially enabling further unauthorized access or lateral movement within affected environments.

No official patch or remediation is currently documented. Users should immediately remove and avoid using the @zzzcrypto/bitcoin-lib package version 6.1.7. Verify all dependencies for malicious packages and replace them with trusted alternatives, such as the legitimate bitcoinjs-lib. Monitor for any signs of credential misuse or unauthorized access resulting from this exfiltration. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.