If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (153163572a9fdf26e63ad50dd80b9fc3a28b22e89dea3e82acbd23a7ed7b265b)
The package is a typosquat of @ethersproject/abstract-signer. On require of the main module, index.js reads the full process.env plus hostname, username, homedir, platform, and cwd, base64-encodes the payload, and sends it via HTTPS GET to api.telegram.org/bot<token>/sendMessage with a hardcoded bot token and chat_id 8969499041. A flag file in the OS temp directory gates repeat sends. The code also attempts to require and re-export the legitimate @ethersproject/abstract-signer to mask the malicious behavior. Any environment variables the installer has exported at import time (AWS_*, GITHUB_TOKEN, NPM_TOKEN, database URLs, etc.) leave the host to the attacker's Telegram chat.