The @zzzcrypto/xrp-lib npm package version 2.14.0 is a malicious package impersonating the legitimate xrpl library. Its index.js script collects detailed system and environment information, including process.env, which often contains sensitive credentials. This information is serialized to JSON, base64-encoded, and exfiltrated to a hardcoded Telegram Bot API endpoint via a GET request. The package suppresses repeated data transmissions using a temporary file flag. The code references another similarly malicious package under a different scope, indicating republishing of the same malicious code. This exfiltration can lead to compromise of developer and CI environment secrets.

Sensitive environment variables and system information are exfiltrated to an attacker-controlled Telegram Bot API endpoint. This includes cloud tokens, npm publish tokens, database URLs, and API keys, which can lead to unauthorized access to cloud services, package repositories, databases, and other critical infrastructure. The malicious package poses a significant risk to confidentiality and integrity of development and deployment environments.

Users should immediately remove and stop using the @zzzcrypto/xrp-lib package version 2.14.0. Replace it only with the legitimate xrpl library from trusted sources. Audit environments for potential credential exposure and rotate any secrets that may have been compromised. There is no vendor patch or official fix since this is a malicious package impersonation; remediation involves removing the package and securing affected credentials.