The npm package web3-utils-crypto impersonates the legitimate web3-utils library and includes stub wallet APIs that return non-functional values. When loaded, it collects extensive environment information including environment variables, system details, and package metadata, then exfiltrates this data via an HTTPS request to a Telegram bot controlled by the attacker. This can lead to leakage of sensitive credentials such as AWS keys, GitHub tokens, and database passwords from developer and CI environments. The malicious behavior is triggered on require(), and a temporary flag file prevents repeated data exfiltration. The affected version is 1.10.4.