@wethenorth12/etherjs

@wethenorth12/etherjs@6.15.3 is a typosquat of the ethers package (package name, description, and author string 'ricmoo' all mimic the real package; index.js re-exports the real 'ethers' when available as a benign facade). Its postinstall hook decodes a base64-embedded Node payload into a randomized directory under the OS tmpdir (os.tmpdir()/.npm-<rand>/setup.js), executes it via process.execPath with execFileSync, and removes the directory 5 seconds later to erase traces. The decoded payload collects hostname, username, home directory, cwd, platform, the full contents of process.env, and the output of the `env` command, then transmits the data base64-wrapped in a GET query string to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot<redacted>/sendMessage, chat_id 8969499041). Because process.env in CI/CD and developer environments routinely contains npm/GitHub/cloud credentials and deployment tokens, this constitutes credential theft against the installer.