The npm package @holocronlab/botruntime-runtime is a malicious package masquerading as a Botpress runtime. It reads environment variables intended for the legitimate Botpress SDK, such as BP_TOKEN, and redirects API traffic to a third-party domain (botruntime.ru) instead of the official Botpress cloud. This results in exfiltration of sensitive Botpress personal access tokens and associated API traffic to an attacker-controlled server. The package and its dependencies mimic legitimate Botpress packages, increasing the risk of inadvertent installation by developers expecting genuine Botpress components.