{"id":"MAL-2026-12064","summary":"Malicious code in ckcc-protocol (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3ebcdc07616ec6ab418a9005e1486d05f3753dc4d37f6ce61c5daed495d31e25)\nThe npm package ckcc-protocol@1.0.2 typosquats the legitimate Coldcard ckcc-protocol tool and ships no functionality (index.js exports {}). Its package.json declares a postinstall script that runs automatically on npm install. The postinstall reads a fixed set of installer-side secret files, including ~/.env*, ~/.npmrc, ~/.aws/credentials, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ssh/id_ecdsa, ~/.config/solana/id.json, and ~/.ethereum/keystore, plus any dotfile whose name matches /wallet|key|secret|seed|mnemonic|keystore|private/i. It bundles the collected file contents together with os.hostname() and os.userInfo().username into a JSON payload and POSTs it via https.request to webhook.site/5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4. The destination is an attacker-controlled request-capture endpoint, not the legitimate Coldcard project.\n\n## Source: ossf-package-analysis (61a440517bf97875e91920faabc309da8fa1bfe264e510fa54e5ffa210bd1d15)\nThe OpenSSF Package Analysis project identified 'ckcc-protocol' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-08-05T07:21:06.129595822Z","published":"2026-08-05T01:47:56Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.0"],"import_time":"2026-08-05T03:11:11.579229337Z","modified_time":"2026-08-05T01:47:56Z","sha256":"61a440517bf97875e91920faabc309da8fa1bfe264e510fa54e5ffa210bd1d15","source":"ossf-package-analysis"},{"id":"IN-MAL-2026-013408","import_time":"2026-08-05T07:06:46.126204252Z","modified_time":"2026-08-05T06:18:47Z","sha256":"36e22727edf29dcfea7bcbeae91ce73b87c89073920063f49ee0664cefd9b0da","source":"amazon-inspector","versions":["1.0.3"]},{"modified_time":"2026-08-05T06:19:27Z","sha256":"3ebcdc07616ec6ab418a9005e1486d05f3753dc4d37f6ce61c5daed495d31e25","source":"amazon-inspector","versions":["1.0.2"],"id":"IN-MAL-2026-013412","import_time":"2026-08-05T07:06:46.331721591Z"},{"sha256":"6ddec53c551e3ca016950072053c063175348cb02ddf7de2f447aa7f43fb96f3","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-013428","import_time":"2026-08-05T07:06:47.104710107Z","modified_time":"2026-08-05T06:21:45Z"},{"source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-013420","import_time":"2026-08-05T07:06:46.780801431Z","modified_time":"2026-08-05T06:20:38Z","sha256":"ee0de5b6e85dca3a1e6ad106366f2c8e2b9b3262c548bc153ea2320702e2bee5"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ckcc-protocol/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ckcc-protocol/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ckcc-protocol/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/ckcc-protocol/v/1.0.1"}],"affected":[{"package":{"name":"ckcc-protocol","ecosystem":"npm","purl":"pkg:npm/ckcc-protocol"},"versions":["1.0.0","1.0.3","1.0.2","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"e89f89726d0e20dccbae6ea5512d2b0a032b00f58a037976a384905e6e4d53b1","tlsh":"152163d220f22721169b168a982a27006377a5672c0bdc807efc1b871f8dc550666bfc"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-bFKyN4bjpPR4jbvERMa0WkrhFNxWSBYq5IaxBHt85bkhQUG3pqIj+CorgXsMuL9+/RZUO4brbf+5pQVsqPOL9Q==","sha1":"cab12a7c267409a10ac559e94aa0989da3b36ec3"},"filename":"ckcc-protocol-1.0.3.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ckcc-protocol/MAL-2026-12064.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}