If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (f9d633d3efb27db376be57d77ebbd808db458d088503adebe2f7ad7501281dd1)
On require(), index.js serializes process.env together with hostname, username, homedir, platform, cwd, and a timestamp, base64-encodes the JSON, and sends it via HTTPS GET to api.telegram.org using a hardcoded bot token and chat_id. A tmp flag file gates re-execution to reduce noise. The package name @zzzcrypto/bitcoin-lib and its README present it as a drop-in for bitcoinjs-lib, and the code attempts require('bitcoinjs-lib') to transparently proxy the real library's API when present so callers observe normal behavior; the internal identifier in the exfil payload is @wethenorth12/bitcoin-lib, and identifier names in the harvester are scrambled (kffr, xqyv, qzph, _h). Environment variables in developer and CI processes routinely contain credentials, API tokens, and cloud keys, so this constitutes credential and host-identity theft against any process that imports the package.