Malicious code in hdkey-wallet (npm)

The npm package hdkey-wallet was published with embedded malicious code that executed on module load. Upon require(), the package read the complete process.env object along with hostname, username, home directory, platform, and current working directory, then JSON-encoded and base64-wrapped the payload before transmitting it via HTTPS to api.telegram.org using a hardcoded Telegram Bot API token and chat ID (8969499041).\n\nThe package was designed to impersonate the legitimate hdkey library, with a deceptive package name and README presenting it as a drop-in replacement. The malicious module attempted to require() the real hdkey library and re-export it, using the legitimate library as functional cover for the credential theft attack.\n\nEnvironments commonly holding sensitive credentials—such as AWS_*, NPM_TOKEN, and GITHUB_TOKEN—were directly exposed to the attacker-controlled Telegram bot. A tmpdir flag file was used to guard against repeated exfiltration attempts.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository (MAL-2026-13346).