The npm package 'mnemonic-to-key' version 1.2.0 contains malicious code that exfiltrates environment variables and system information to a Telegram bot on first import. It acts as a typosquat for the legitimate 'bip39' package, targeting cryptocurrency developers by capturing sensitive data such as API tokens and cloud credentials from process environments. The package sends this data encoded via HTTPS GET requests and suppresses repeated transmissions using a flag file.