{"id":"MAL-2026-12096","summary":"Malicious code in @wethenorth12/hdkey-wallet (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3e9eb2c497323415e826c9de190e636c2dea959708898550db20676d0c1ae6da)\nindex.js runs at require() time: it collects hostname, username, homedir, platform, cwd, and the entire process.env, JSON-serializes and base64-encodes the payload, and sends it as a GET to https://api.telegram.org/bot\u003credacted\u003e/sendMessage?chat_id=8969499041 using a hardcoded bot token. A marker file under tmpdir (.npi-) gates single-shot execution. After exfiltration the module attempts require('hdkey') and re-exports it if present; otherwise it returns stub wallet functions (createWallet, generateMnemonic returning randomBytes(32)) so callers get plausible-looking results while the stealer runs. The package advertises itself as a drop-in replacement for hdkey. In CI and developer environments process.env commonly contains AWS_*, GITHUB_TOKEN, NPM_TOKEN, and database credentials, all of which leave the host to the attacker-controlled Telegram chat on every require.\n","modified":"2026-08-05T07:20:54.951742141Z","published":"2026-08-05T06:23:04Z","database_specific":{"malicious-packages-origins":[{"sha256":"3e9eb2c497323415e826c9de190e636c2dea959708898550db20676d0c1ae6da","source":"amazon-inspector","versions":["2.1.0"],"id":"IN-MAL-2026-013437","import_time":"2026-08-05T07:06:47.48643046Z","modified_time":"2026-08-05T06:23:04Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wethenorth12/hdkey-wallet/v/2.1.0"}],"affected":[{"package":{"name":"@wethenorth12/hdkey-wallet","ecosystem":"npm","purl":"pkg:npm/%40wethenorth12/hdkey-wallet"},"versions":["2.1.0"],"database_specific":{"indicators":{"evidence_files":[{"tlsh":"e02141cc27f1f98e123361d1656f750bb2bbcae24888ea60d1a4d5c32f741c89965398","path":"index.js","sha256":"0f8b5505e3627b2d23d7e45acb9e66b7959ab5b083a44c022e7e8f4e7c55fa78"}],"package_integrity":[{"filename":"hdkey-wallet-2.1.0.tgz","hashes":{"sha512_sri":"sha512-M48XyqtWb+q8Mdy0VoiINgx8Os0AiZ0iFGSiKMUNw6bC6krF9I2pzKxUDVLbdbTphkdNQN4/cBVnkJJbLxLz1w==","sha1":"0f58b72889edefe713be7245c63b20e7bb5864e7"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/hdkey-wallet/MAL-2026-12096.json","cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}