{"id":"MAL-2026-12067","summary":"Malicious code in hwi-lib (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (687b96d2fb386735a783701f54b1740fad0e16e1dc153ebcf7f07dd5506d23db)\nhwi-lib@1.0.1 ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads installer credential files (~/.aws/credentials, ~/.ssh/id_rsa, id_ed25519, id_ecdsa, ~/.npmrc, ~/.gitconfig, ~/.config/solana/id.json, ~/.ethereum/keystore,.env variants) and walks hidden subdirectories of the user's home directory reading any file matching wallet|key|secret|seed|mnemonic|keystore|private or ending in.json/.pem/.key. The collected contents are POSTed via https.request to the hardcoded endpoint https://enxhcjpo5ev.x.pipedream.net/c. Package name and 'crypto utility' description impersonate the HWI (Hardware Wallet Interface) tooling while the shipped module exports nothing, indicating a lure.\n\n## Source: ossf-package-analysis (b354ab4fac90ce3cb0a5afb1a00d518a9a44e8a4da73e66845415e69ec620973)\nThe OpenSSF Package Analysis project identified 'hwi-lib' @ 1.0.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-08-05T07:21:15.656340136Z","published":"2026-08-05T01:52:47Z","database_specific":{"malicious-packages-origins":[{"source":"ossf-package-analysis","versions":["1.0.1"],"import_time":"2026-08-05T03:11:11.787482564Z","modified_time":"2026-08-05T01:52:47Z","sha256":"b354ab4fac90ce3cb0a5afb1a00d518a9a44e8a4da73e66845415e69ec620973"},{"sha256":"b384001368ca7ec877e30cd38551e5a8d27c7cb5802d745c8635e1988777ed6e","source":"ossf-package-analysis","versions":["1.0.0"],"import_time":"2026-08-05T03:11:12.140870321Z","modified_time":"2026-08-05T02:07:43Z"},{"id":"IN-MAL-2026-013413","import_time":"2026-08-05T07:06:46.367556116Z","modified_time":"2026-08-05T06:19:35Z","sha256":"687b96d2fb386735a783701f54b1740fad0e16e1dc153ebcf7f07dd5506d23db","source":"amazon-inspector","versions":["1.0.1"]},{"source":"amazon-inspector","versions":["1.0.2"],"id":"IN-MAL-2026-013407","import_time":"2026-08-05T07:06:46.087225193Z","modified_time":"2026-08-05T06:18:40Z","sha256":"9811fc912ded9092f6b545a1e36c81b4f763c31fb141de0cb6c8fb22d4b6e54e"},{"sha256":"f631ccb5df4527d7ed8233bbd74a7973d492949f7f547177aa057e126d3c365f","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-013430","import_time":"2026-08-05T07:06:47.174089355Z","modified_time":"2026-08-05T06:22:02Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hwi-lib/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hwi-lib/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hwi-lib/v/1.0.0"}],"affected":[{"package":{"name":"hwi-lib","ecosystem":"npm","purl":"pkg:npm/hwi-lib"},"versions":["1.0.1","1.0.0","1.0.2"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"tlsh":"f54134d505df162154476bd8862b31107277e2d7344aa9c43e9c6b198f1d8384a5affc","path":"postinstall.js","sha256":"cb89d25cb941a6c4f7b12d049518b8756e9a4ce84ddaedb89c225795487ca171"},{"sha256":"6f6fb7d0f867ee46ce122fe92a6fe1592266ee155310313ef858a4a5aca98aa3","tlsh":"ffd02b101b5afa305fec8e995c3a886d049b2110808dc59d07f78078c2d679a880d41a","path":"package.json"}],"package_integrity":[{"filename":"hwi-lib-1.0.1.tgz","hashes":{"sha512_sri":"sha512-NqBlbzZo7EHeA9QsSXPAtkgsP7gnoPH7X2WW1dxLdEW76gTHnCCrLQ6pHHUGRN4toDjIEDJHWvh5IKXFKtWnYA==","sha1":"fa02df144587a41a0b18d0758240f10d746d1d9a"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hwi-lib/MAL-2026-12067.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}