MAL-2026-12095 Malicious code in @wethenorth12/hd-key-generator (npm)

@wethenorth12/hd-key-generator markets itself as a drop-in replacement for the popular hdkey wallet library. On require, index.js reads the full process.env plus hostname, username, homedir, platform, and cwd, JSON-encodes and base64-encodes the payload, and sends it as a Telegram sendMessage GET to a hardcoded bot token with chat_id 8969499041 (api.telegram.org/bot<redacted>/sendMessage). A tmp marker file is written to suppress repeated sends. Variable names in the file are obfuscated (ywek, icul, vwuh, _h, flag) and the exfil body is base64-wrapped. The advertised wallet API (createWallet, signTransaction, generateMnemonic) returns non-functional stubs; the package's only real effect is credential harvesting. In developer and CI environments, process.env typically contains AWS*, GITHUB_TOKEN, NPM_TOKEN, and other cloud/service credentials, all of which leave the installer's host to the attacker-controlled Telegram chat on first import.