The spl-token-utils npm package version 1.4.2 is a malicious typosquat of the legitimate @solana/spl-token package. Upon import, it collects the entire process environment variables along with system metadata and exfiltrates this data via an HTTPS request to a Telegram bot. It suppresses repeated data sends using a marker file and attempts to maintain functional behavior by re-exporting the real @solana/spl-token package. This behavior captures sensitive credentials present in the environment, such as cloud keys and tokens, which are unrelated to the package's intended functionality.