{"id":"MAL-2026-13367","summary":"Malicious code in clawtrl-wallet (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d56c06b4b1f063e6827dc0d8e9a6e3d1b7395182c12188b4dc110b771c23386c)\nThe package's cli.js imports child_process, https, and os, reads process.env and system information (via os.tmpdir and related os APIs), spawns a bash subprocess, and issues outbound https.get requests. The composition — environment/system-data read paired with a bash spawn and outbound HTTPS from a wallet-branded npm package — matches the credential/wallet-stealer shape rather than any legitimate wallet library behavior. Wallet packages have no need to shell out to bash or transmit environment contents off-host, and the package name suggests impersonation of a wallet utility to lure installers.\n","modified":"2026-08-05T19:19:47.016062921Z","published":"2026-08-05T18:12:01Z","database_specific":{"malicious-packages-origins":[{"sha256":"d56c06b4b1f063e6827dc0d8e9a6e3d1b7395182c12188b4dc110b771c23386c","source":"amazon-inspector","versions":["1.5.1"],"id":"IN-MAL-2026-015845","import_time":"2026-08-05T19:04:54.08948802Z","modified_time":"2026-08-05T18:12:01Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/clawtrl-wallet/v/1.5.1"}],"affected":[{"package":{"name":"clawtrl-wallet","ecosystem":"npm","purl":"pkg:npm/clawtrl-wallet"},"versions":["1.5.1"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"sha256":"78c38d617be45b5432c700c565e414e35779b744e9b8338e2487259b4f8b83b7","tlsh":"0941815f46f2013166b3918d46179c26b483c4236210ea90bbed0115afc2975c1a77ff","path":"cli.js"}],"package_integrity":[{"hashes":{"sha1":"ac228f81d3f3389147fe4395a3b7c8be1c6a3e06","sha512_sri":"sha512-wj8R5SmFHH3l/7anYyFAsuEJLD7E4JYo8K4HUyqIq4cNJ4SUR7ygtYVMzX76/F+Hn7QLDSgqyW8ASkU+2GcbRg=="},"filename":"clawtrl-wallet-1.5.1.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/clawtrl-wallet/MAL-2026-13367.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}