If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (4b36c64fed7b6d50787a971cc649c1f97605f6ea7027f388e9185ea85a580013)
On module load, index.js reads the complete process.env object along with hostname, username, home directory, platform, and current working directory, JSON-encodes and base64-wraps the payload, and transmits it via https.get to api.telegram.org's Bot API using a hardcoded bot token and chat_id 8969499041. A tmpdir flag file guards against repeated exfiltration. The package name and README present it as a drop-in replacement for the legitimate `hdkey` library, and the module attempts to require('hdkey') and re-export it when present, using the real library as a functional cover for the credential theft that fires on require(). Environments commonly holding secrets such as AWS_*, NPM_TOKEN, and GITHUB_TOKEN in process.env are directly exposed to the attacker-controlled Telegram bot.