{"id":"MAL-2026-13693","summary":"Malicious code in cryptostock (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9ab293d041a75fa4fcfb65c996176a885720e7b60cf3dde4b19154c073c29454)\nindex.js is an obfuscated payload that, on require(), starts a C2 client against https://badai.run.place: it registers a UID, long-polls /cekappapiapi.php for shell commands, executes them via child_process.exec, and POSTs stdout/stderr back to /fallback.php (AES-256-ECB encrypted). After a randomized 2-8 minute delay it enumerates installer-owned secret directories (/root/.ssh, /home/*/.ssh, /opt/wallet-keys, /etc/ssl/private, ~/.ethereum/keystore, /var/lib/ethereum/keystore, /mnt/crypto/wallets) via `find` for *.pem/*.key/UTC--*/keystore files, filters those containing 'PRIVATE KEY', and reads process.env.ETH_PRIVATE_KEY; matches are exfiltrated to badai.run.place. For each harvested 64-hex private key the code instantiates web3 against Infura mainnet and broadcasts a signed ETH transfer of the account balance (minus gas) to a hardcoded drain address. Strings including module names, the C2 host, private-key markers, and keystore paths are base64-encoded in a string table and decoded at runtime; the file header self-identifies as an obfuscated build integrating StealthC2 from Badnew.py.\n","modified":"2026-08-10T12:50:26.519419442Z","published":"2026-08-10T11:54:05Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.1"],"id":"IN-MAL-2026-017234","import_time":"2026-08-10T12:24:44.893199219Z","modified_time":"2026-08-10T11:54:21Z","sha256":"9ab293d041a75fa4fcfb65c996176a885720e7b60cf3dde4b19154c073c29454","source":"amazon-inspector"},{"modified_time":"2026-08-10T11:54:05Z","sha256":"b306961ecb92b341504593a0cb19a1128fe8cfb7e610a52615e0dbe146b73d66","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-017232","import_time":"2026-08-10T12:24:44.70437469Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cryptostock/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/cryptostock/v/1.0.0"}],"affected":[{"package":{"name":"cryptostock","ecosystem":"npm","purl":"pkg:npm/cryptostock"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"sha256":"04551dc0e3407469c27ada80e27a767d12034837a1e58ae5eedcd76faa374cac","tlsh":"bb12222206f7317856a37897732f3061f272a4272c89dda63d6d81244f8d528caf97f6","path":"index.js"}],"package_integrity":[{"hashes":{"sha1":"b084f65e6d9cac336345c54d4ea3970e46009535","sha512_sri":"sha512-Z3xC8Qqa2L8v9uAzGEEXjVK64l8LM2ssi9h4WXGK+w3dmbrLPo0W6Ef3burpWSCNO78Z6n9Dry5d1GXNHOZCgw=="},"filename":"cryptostock-1.0.1.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cryptostock/MAL-2026-13693.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}