The @zzzcrypto/playwrite npm package is a malicious typosquatting package designed to steal sensitive environment data from users who import it. Upon require(), it harvests the full process environment variables and system information, encodes this data, and exfiltrates it to an attacker-controlled Telegram Bot API endpoint. The package name closely resembles the legitimate 'playwright' package, potentially tricking developers into installing it. It attempts to require 'playwright' and falls back to unrelated wallet functions, confirming it has no legitimate purpose matching its advertised name. This exfiltration can expose sensitive tokens and credentials commonly found in environment variables, posing a significant security risk.

Sensitive environment data including CI tokens, cloud provider keys, and npm publish tokens can be exfiltrated to an attacker-controlled endpoint. This can lead to unauthorized access to cloud resources, continuous integration systems, and npm publishing capabilities. The compromise occurs simply by importing the malicious package, making it a critical supply chain risk.

No official patch or remediation is currently available. Users should immediately audit their dependencies to ensure they are not using the @zzzcrypto/playwrite package, especially version 1.48.0. Remove the package if found and rotate any potentially exposed credentials such as CI tokens, cloud keys, and npm tokens. Use exact package names and verify package authenticity before installation to avoid typosquatting attacks.