@zzzcrypto/[email protected] is a malicious npm package designed to impersonate the legitimate @solana/spl-token package. It enumerates the full process environment variables and system details (hostname, username, home directory, platform, current working directory), encodes this information in base64, and sends it via an HTTPS GET request to a Telegram bot endpoint controlled by the attacker. The package uses obfuscated variable names and a flag file to limit exfiltration to once per host. If the legitimate @solana/spl-token package is not present, it falls back to a stub API that returns random bytes instead of valid cryptographic keys, potentially disrupting dependent applications. Sensitive environment variables commonly found in developer and CI environments, such as AWS credentials, GitHub tokens, and NPM tokens, are exposed and exfiltrated.

Sensitive environment variables and system information from developer and continuous integration environments can be exfiltrated to an attacker-controlled Telegram chat. This can lead to credential compromise, unauthorized access to cloud services, source code repositories, and package registries. The stub API fallback may also cause functional disruption in applications expecting legitimate cryptographic key material.

Do not install or use the @zzzcrypto/solana-spl-token package. Verify that only the legitimate @solana/spl-token package is installed in your projects. Remove any instances of @zzzcrypto/[email protected] from your environment. Rotate any potentially exposed credentials such as AWS keys, GitHub tokens, and NPM tokens. Monitor for suspicious network activity related to Telegram API endpoints. No official patch or fix exists for this malicious package; remediation involves removal and credential rotation.