The hdkey-wallet npm package version 2.1.0 contains malicious code that exfiltrates environment variables and system information to an attacker-controlled Telegram bot. It masquerades as a drop-in replacement for the legitimate hdkey library, forwarding legitimate functionality while stealing sensitive credentials such as AWS, NPM, and GitHub tokens from process.env. The exfiltration occurs once per environment due to a temporary flag file. No official patch or remediation guidance is currently provided.