{"id":"MAL-2026-12085","summary":"Malicious code in @wethenorth12/bip39-generator (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687)\nPackage presents itself as a drop-in replacement for the popular `bip39` library but ships a credential stealer in its main entry. On require, the module serializes the full process.env plus hostname, username, home directory, platform, and cwd, base64-encodes the payload, and sends it via HTTPS GET to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot\u003ctoken\u003e/sendMessage?chat_id=8969499041). A marker file ('.npi-...') is written to /tmp to ensure the beacon fires only once per host. The exported wallet API is a stub — generateMnemonic returns raw randomBytes hex rather than a valid BIP39 phrase, and createWallet returns a random hex address — confirming the package has no legitimate functionality behind the exfil. Bulk process.env dumps routinely contain AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, NPM_TOKEN, database passwords, and CI secrets, all of which are captured and delivered to the attacker's Telegram chat.\n","modified":"2026-08-05T07:20:49.344958437Z","published":"2026-08-05T06:25:15Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["3.1.2"],"id":"IN-MAL-2026-013452","import_time":"2026-08-05T07:06:48.16550095Z","modified_time":"2026-08-05T06:25:15Z","sha256":"e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wethenorth12/bip39-generator/v/3.1.2"}],"affected":[{"package":{"name":"@wethenorth12/bip39-generator","ecosystem":"npm","purl":"pkg:npm/%40wethenorth12/bip39-generator"},"versions":["3.1.2"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"772144c827f1f94e12336182546f210e727fcaa21488f660c564d4976fb41c85565398","path":"index.js","sha256":"b64d57a845e7778dcbaa6cb3d3d0d4b7354db23c9d300fe1d310692989039bbd"}],"package_integrity":[{"hashes":{"sha1":"79d95cb8bceed1268b9cd7c6ca7f5b1aefe0bb27","sha512_sri":"sha512-QeIcywWvp7vbOk1wCpgYaH3Li0YuVzF1NjHI9bdj4sA101ewQnoUODwB2Wr0iD8nlacbESjxjlt49/4Y1kTPWA=="},"filename":"bip39-generator-3.1.2.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/bip39-generator/MAL-2026-12085.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}