Malicious cryptocurrency wallet-drainer disguised as a JavaScript utility. index.js auto-executes on require/import, reads the host .env for PRIVATE_KEY/SECRET/MNEMONIC values, and attempts to transfer funds to hardcoded attacker-controlled wallets across ~26 chains via ethers.Wallet.sendTransaction. This published build is incomplete (a SOURCE_WALLET placeholder throws before the transfer, so it likely does not complete a theft as shipped), but the design, the crypto deps (@solana/web3.js, ethers, bitcoinjs-lib) vs the stated utility purpose, and the hardcoded attacker wallets make the malicious intent unambiguous. Same drainer template reused across multiple @js-lib-team utility-named packages (maintainer node-lib-team / security.team24@gmail.com).