hd-key-generator @1.6.3

Summary

hd-key-generator is a typosquat of the hdkey package. On require(), index.js reads process.env, os.hostname(), os.userInfo().username, the user's home directory, platform, cwd, and package metadata, JSON-serializes and base64-encodes the payload, then issues an HTTPS GET to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot<token>/sendMessage) with chat_id=8969499041. A tmp marker file is used to gate repeat sends. If the real hdkey package is present, it is re-exported to preserve apparent functionality; otherwise stub functions are returned. The full process.env dump captures any secrets the installer's shell or CI has exported (AWS_*, GITHUB_TOKEN, NPM_TOKEN, database credentials, and similar).

Source: amazon-inspector (3a102f1d05a0bd89af765e457c2b5d6121ec831d33549d0cbf9795d58b0d3ee6)