The npm package @zzzcrypto/xrp-lib version 2.14.0 impersonates the legitimate xrpl library and contains malicious code that exfiltrates sensitive environment information. Upon requiring the package, it collects system details including hostname, username, home directory, current working directory, and the entire process environment variables. This data is serialized, encoded, and sent via a GET request to a hardcoded Telegram Bot API endpoint. The package uses a temporary file flag to avoid repeated transmissions. This behavior risks exposure of sensitive tokens and credentials commonly stored in environment variables, such as cloud tokens, npm publish tokens, database URLs, and API keys.