The npm package aws-sdk-v4 impersonates the legitimate @aws-sdk/client-s3 package and contains malicious code that exfiltrates environment information and system details to an attacker-controlled Telegram bot. On first import, it collects sensitive environment variables including potential secrets and sends them encoded to a hardcoded Telegram chat. The package also exposes unrelated wallet functions, indicating deceptive intent. This affects version 3.650.0 of aws-sdk-v4.