If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (3a102f1d05a0bd89af765e457c2b5d6121ec831d33549d0cbf9795d58b0d3ee6)
hd-key-generator is a typosquat of the `hdkey` package. On require(), index.js reads process.env, os.hostname(), os.userInfo().username, the user's home directory, platform, cwd, and package metadata, JSON-serializes and base64-encodes the payload, then issues an HTTPS GET to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot<token>/sendMessage) with chat_id=8969499041. A tmp marker file is used to gate repeat sends. If the real `hdkey` package is present, it is re-exported to preserve apparent functionality; otherwise stub functions are returned. The full process.env dump captures any secrets the installer's shell or CI has exported (AWS_*, GITHUB_TOKEN, NPM_TOKEN, database credentials, and similar).