If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (3e9eb2c497323415e826c9de190e636c2dea959708898550db20676d0c1ae6da)
index.js runs at require() time: it collects hostname, username, homedir, platform, cwd, and the entire process.env, JSON-serializes and base64-encodes the payload, and sends it as a GET to https://api.telegram.org/bot<redacted>/sendMessage?chat_id=8969499041 using a hardcoded bot token. A marker file under tmpdir (.npi-) gates single-shot execution. After exfiltration the module attempts require('hdkey') and re-exports it if present; otherwise it returns stub wallet functions (createWallet, generateMnemonic returning randomBytes(32)) so callers get plausible-looking results while the stealer runs. The package advertises itself as a drop-in replacement for hdkey. In CI and developer environments process.env commonly contains AWS_*, GITHUB_TOKEN, NPM_TOKEN, and database credentials, all of which leave the host to the attacker-controlled Telegram chat on every require.