Malicious npm package dotenv-precheck can collect BIP-39 seed phrases and WIF keys from a developer's machine
According to the advisory, the dotenv-precheck package, posing as a dotenv checking utility, registers its script as postinstall, so it runs automatically when dependencies are installed. The obfuscated code recursively traverses the home directory, including Desktop, Documents and Downloads, reads text files and selects values matching secret patterns: variables containing KEY, SECRET, TOKEN, PASSWORD, SEED, MNEMONIC, WALLET, private keys in Base58 WIF format, and BIP-39 mnemonics validated against the wordlist and checksum. The collected material is sent to the attacker's Telegram bot. The package has none of its claimed functionality, so the sole purpose of installation is to steal secrets.
Check lock files, CI images and local environments for this package right now. If it was installed, treat all secrets from that machine as compromised: regenerate seed phrases and private keys in a trusted, clean environment, transfer funds to new addresses, and revoke and reissue API tokens and passwords. Do not store seed phrases and keys in text files on machines where npm install is run; details are at the link below.
Source: github.com