{"id":"MAL-2026-13213","summary":"Malicious code in @zzzcrypto/playwrite (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c297b354235cda442a2ca4057884b85f1e29a920c6dcae318ab8149770ad80d0)\nOn require() of @zzzcrypto/playwrite, index.js harvests the installer's full process.env plus hostname, username, homedir, platform, cwd, and package identity, base64-encodes the payload, and issues an HTTPS GET to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot\u003credacted\u003e/sendMessage?chat_id=8969499041) with the encoded data in the `text` query parameter. A tmpdir flag file guards against repeat sends. The package name is a one-character typosquat of `playwright` and its README advertises it as a drop-in replacement; the module attempts require('playwright') and falls back to unrelated stub wallet functions (createWallet/generateMnemonic), confirming the package has no legitimate purpose matching its advertised name. Full process.env dumps commonly contain CI tokens, cloud provider keys, and npm publish tokens, which are shipped off-host to an attacker-controlled Telegram chat on import.\n","modified":"2026-08-05T16:50:18.156300559Z","published":"2026-08-05T15:32:21Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015737","import_time":"2026-08-05T16:13:38.306878342Z","modified_time":"2026-08-05T15:32:21Z","sha256":"c297b354235cda442a2ca4057884b85f1e29a920c6dcae318ab8149770ad80d0","source":"amazon-inspector","versions":["1.48.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@zzzcrypto/playwrite/v/1.48.0"}],"affected":[{"package":{"name":"@zzzcrypto/playwrite","ecosystem":"npm","purl":"pkg:npm/%40zzzcrypto/playwrite"},"versions":["1.48.0"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-jja0E3pBz+IonH4jNIsOgQ/D9PvZcu72o1Am0UdICZsqohe4vA/yWqLUNVGhppAZqfF21Y/bzIoTtfO3xVKOww==","sha1":"a84bbd1e1a4cadc1e6ff6fbeed496ca5eebf4cc4"},"filename":"playwrite-1.48.0.tgz"}],"evidence_files":[{"tlsh":"8b2133cc37f1f48e2273e192aa6f650bb6bbc9e10488e710e5a4d1c32fb41cc9955798","path":"index.js","sha256":"11e720930e3fbc3057455466abdee00c3b0e3875b00fa1032a18edacdd335b7f"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzcrypto/playwrite/MAL-2026-13213.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}