If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (7d7f9cee39cc030c866ec58a0744ef387333cf5578a35f4b10aa211c19c61b7b)
@wethenorth12/spl-token-utils advertises itself as a drop-in replacement for @solana/spl-token. On require(), index.js serializes the full process.env together with hostname, username, homedir, platform, cwd, and a timestamp, base64-encodes the JSON, and sends it via HTTPS GET to api.telegram.org bot 7231970337 chat_id 8969499041. A sentinel file in the temp directory suppresses repeat sends. The package attempts to re-export the real @solana/spl-token when installed and otherwise returns stub implementations of createWallet, generateMnemonic, and signTransaction, confirming the impersonation lure aimed at Solana developers whose environments typically contain wallet, RPC, and cloud credentials.