Malicious code in hd-key-generator (npm)

hd-key-generator is a malicious npm package that impersonates the legitimate hdkey library through typosquatting. Upon being required, the package's index.js reads sensitive data including process.env, os.hostname(), os.userInfo().username, the user's home directory, platform, current working directory, and package metadata.\n\nThe collected data is JSON-serialized, base64-encoded, and exfiltrated via HTTPS GET request to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot/sendMessage) with chat_id=8969499041. A temporary marker file is used to prevent repeated transmissions of the same data.\n\nThe package attempts to preserve functionality by re-exporting the legitimate hdkey package if present on the system, or returning stub functions otherwise. This deceptive behavior increases the likelihood of the malicious code going undetected.\n\nThe full process.env dump is particularly dangerous as it captures any secrets exported by the installer's shell or CI environment, including AWS credentials, GitHub tokens, NPM tokens, and database credentials.