@wethenorth12/hd-key-generator

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (0b2e832840746236ecbc71ba886ec793620dd508cd2a75eca04bd44e575cb03b)
@wethenorth12/hd-key-generator markets itself as a drop-in replacement for the popular `hdkey` wallet library. On require, index.js reads the full process.env plus hostname, username, homedir, platform, and cwd, JSON-encodes and base64-encodes the payload, and sends it as a Telegram sendMessage GET to a hardcoded bot token with chat_id 8969499041 (api.telegram.org/bot<redacted>/sendMessage). A tmp marker file is written to suppress repeated sends. Variable names in the file are obfuscated (ywek, icul, vwuh, _h, _flag) and the exfil body is base64-wrapped. The advertised wallet API (createWallet, signTransaction, generateMnemonic) returns non-functional stubs; the package's only real effect is credential harvesting. In developer and CI environments, process.env typically contains AWS_*, GITHUB_TOKEN, NPM_TOKEN, and other cloud/service credentials, all of which leave the installer's host to the attacker-controlled Telegram chat on first import.

Compromised versions (1)

• 1.6.3

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.