@wethenorth12/mnemonic-to-key @1.2.0

Summary

Package advertises itself as a drop-in replacement for bip39 and exposes stub wallet functions (createWallet, generateMnemonic) to attract wallet-handling projects. On module load, index.js reads the full process.env dictionary along with hostname, username, home directory, platform, and cwd, JSON-encodes and base64-encodes the payload, and transmits it as a URL query parameter to a hardcoded Telegram Bot API sendMessage endpoint (bot 7231970337, chat 8969499041). A temporary flag file is written to suppress repeated sends. Environment variables in developer and CI environments routinely contain cloud credentials, npm/GitHub tokens, and database secrets, so the require-time beacon is a direct credential-theft channel controlled by the package author.

Source: amazon-inspector (c373b3f6b1c60d079fb7c63d13a51f7e42ee41feeff2c04c5ab925ad5dad41fb)