If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (d1f0dfc7ad97140ef740758424cd859d9c25ee55a6d6346859cebaf1e64cdce9)
web3-utils-crypto impersonates the web3-utils library (package description: 'Drop-in replacement for web3-utils') and ships stub wallet APIs including generateMnemonic and createWallet that return non-functional random values. On require(), index.js serializes the full process.env plus os.hostname, username, homedir, platform, cwd, package name/version and timestamp, base64-encodes the payload, and sends it via HTTPS GET to https://api.telegram.org/bot<token>/sendMessage with chat_id 8969499041 (bot id 7231970337). A tmp flag file suppresses repeat sends. process.env on developer and CI machines routinely contains AWS_*, GITHUB_TOKEN, NPM_TOKEN, DB_PASSWORD and similar credentials, so any consumer that installs and loads this package leaks its full environment to the attacker-controlled Telegram chat.