MAL-2026-13354

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (d1f0dfc7ad97140ef740758424cd859d9c25ee55a6d6346859cebaf1e64cdce9) web3-utils-crypto impersonates the web3-utils library (package description: 'Drop-in replacement for web3-utils') and ships stub wallet APIs including generateMnemonic and createWallet that return non-functional random values. On require(), index.js serializes the full process.env plus os.hostname, username, homedir, platform, cwd, package name/version and timestamp, base64-encodes the payload, and sends it via HTTPS GET to https://api.telegram.org/bot<token>/sendMessage with chat_id 8969499041 (bot id 7231970337). A tmp flag file suppresses repeat sends. process.env on developer and CI machines routinely contains AWS_*, GITHUB_TOKEN, NPM_TOKEN, DB_PASSWORD and similar credentials, so any consumer that installs and loads this package leaks its full environment to the attacker-controlled Telegram chat.