@zzzcrypto/etherjs is a malicious npm package designed as a typosquat of the popular 'ethers' library. Upon being loaded, it gathers the full process environment variables, hostname, username, home directory, platform, current working directory, and package identifiers. This information is serialized to JSON, base64-encoded, and sent via an HTTPS GET request to a hardcoded Telegram Bot API endpoint, identified by a specific bot token and chat ID. The package disguises itself by using a different internal scope '@wethenorth12/etherjs' and impersonates the legitimate package author 'ricmoo'. This indicates a reused attack template targeting developers who mistakenly install similarly named malicious packages, potentially leaking sensitive credentials and environment data.

Sensitive environment variables and system information, including credentials such as AWS keys, GitHub tokens, and NPM tokens, can be exfiltrated to an attacker-controlled Telegram endpoint. This can lead to credential compromise, unauthorized access to cloud services, source code repositories, and other critical infrastructure. The malicious package's presence in a development or CI environment poses a significant risk of secret leakage.

No official patch or remediation is available since this is a malicious typosquat package rather than a vulnerability in legitimate software. The recommended mitigation is to avoid installing packages from untrusted or unknown sources and verify package names carefully before installation. Use official package repositories and enable supply chain security measures such as package signing and integrity verification. Remove the @zzzcrypto/etherjs package if found in your environment and rotate any potentially exposed credentials immediately.