Malicious cryptocurrency wallet-drainer disguised as a JavaScript object-utility. index.js auto-executes on require/import, reads the host .env for PRIVATE_KEY/SECRET/MNEMONIC, and attempts to send funds to hardcoded attacker wallets via ethers.Wallet.sendTransaction. As shipped the build is incomplete (a literal SOURCE_WALLET placeholder passed to getBalance throws UNCONFIGURED_NAME at index.js:51, before any transfer), so it does not complete a theft in this version, but the design, crypto deps (@solana/web3.js/ethers/bitcoinjs-lib) vs the stated purpose, and hardcoded attacker wallets make the malicious intent unambiguous. Third package from the same owner as @js-lib-team/string-utils and @js-lib-team/env-parser (identical drainer template; maintainer node-lib-team / security.team24@gmail.com).