{"id":"MAL-2026-12086","summary":"Malicious code in @wethenorth12/bip39-mnemonic (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d0b607f30d6abb6d568a9a52ff027cea51c7a1efccc54c2fa59a8acc2d6f0386)\nOn require of the package's main entrypoint, the module collects hostname, username, home directory, platform, cwd, and the entire process.env, base64-encodes the JSON blob, and sends it as a Telegram sendMessage HTTP GET to a hardcoded bot token with chat_id=8969499041 on api.telegram.org. A tmp flag file suppresses repeat sends. The bulk process.env dump routinely contains installer credentials (AWS_*, NPM_TOKEN, GH_TOKEN, DB_PASSWORD, CI secrets), all of which are compromised on first import. The package additionally typosquats the legitimate `bip39` library: package name, description, keywords and README (\"Drop-in replacement for bip39\") mimic it, and the `author` field is set to `bitcoinjs-lib` to impersonate an established maintainer. When the real `bip39` is not present the package exposes a stub `generateMnemonic`/`createWallet` returning `crypto.randomBytes(32).toString('hex')` — non-standard mnemonic material that diverges from BIP-39 and would produce attacker-observable or non-recoverable wallet keys if used by downstream code.\n","modified":"2026-08-05T07:20:50.524536826Z","published":"2026-08-05T06:24:49Z","database_specific":{"malicious-packages-origins":[{"sha256":"d0b607f30d6abb6d568a9a52ff027cea51c7a1efccc54c2fa59a8acc2d6f0386","source":"amazon-inspector","versions":["2.3.1"],"id":"IN-MAL-2026-013449","import_time":"2026-08-05T07:06:47.985333653Z","modified_time":"2026-08-05T06:24:49Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wethenorth12/bip39-mnemonic/v/2.3.1"}],"affected":[{"package":{"name":"@wethenorth12/bip39-mnemonic","ecosystem":"npm","purl":"pkg:npm/%40wethenorth12/bip39-mnemonic"},"versions":["2.3.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/bip39-mnemonic/MAL-2026-12086.json","indicators":{"evidence_files":[{"sha256":"ec4517521407ede429afda1c2d8d9cefcd941098e4446acd143651f18361a0fc","tlsh":"3e21668837f1f54d12336591a45f650bb2bfc6e20884ea50d168d5c32fb51c895a93f8","path":"index.js"},{"path":"package.json","sha256":"2921d2552c5a86b7eed3e84ca6563ce7231a40fdce77a127897b7623df7c6e47","tlsh":"f7f04ca0d918593306f81f909c662452735a0c8f4c04bc1e23eb511e47cf46755fd23c"}],"package_integrity":[{"filename":"bip39-mnemonic-2.3.1.tgz","hashes":{"sha1":"df8abe8eb791f05453713ea3660ee639b2da4a58","sha512_sri":"sha512-LkuU9o4BY9RsyHNCy/3qacso0oxHKgj2Y5nSplXOIqS3WO/XS9KIAi7UMlQSY9sSWGOaTkD7aOH22csmsvwyvQ=="}}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}