The bip39-generator npm package version 3.1.2 is a malicious typosquatting package that exfiltrates environment variables and host information to an attacker's Telegram channel. It masquerades as a drop-in replacement for the legitimate bip39 package but exports non-functional wallet and mnemonic functions. On load, it collects sensitive environment data and sends it encoded via HTTPS GET requests to a hardcoded Telegram bot endpoint, potentially leaking API keys, cloud credentials, and CI secrets.