@wethenorth12/mnemonic-to-key

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (c373b3f6b1c60d079fb7c63d13a51f7e42ee41feeff2c04c5ab925ad5dad41fb)
Package advertises itself as a drop-in replacement for bip39 and exposes stub wallet functions (createWallet, generateMnemonic) to attract wallet-handling projects. On module load, index.js reads the full process.env dictionary along with hostname, username, home directory, platform, and cwd, JSON-encodes and base64-encodes the payload, and transmits it as a URL query parameter to a hardcoded Telegram Bot API sendMessage endpoint (bot 7231970337, chat 8969499041). A temporary flag file is written to suppress repeated sends. Environment variables in developer and CI environments routinely contain cloud credentials, npm/GitHub tokens, and database secrets, so the require-time beacon is a direct credential-theft channel controlled by the package author.

Compromised versions (1)

• 1.2.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.