{"id":"MAL-2026-15638","summary":"Malicious code in test__123q2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1b08920ddaa70b578792ec7097f9d47047bdfe436a44475ed8274037ce6d6386)\nOn npm install, the package's postinstall script sweeps the installer's home directory for crypto wallet and credential material and uploads it to an attacker-controlled Telegram bot. Targets include browser wallet extension profiles for MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), Phantom, Trust, Coinbase, OKX, Rabby, Keplr, TronLink, Ronin, Solflare and Exodus; desktop wallets Exodus, Atomic, Electrum, Bitcoin Core (wallet.dat), Ledger Live, Trezor Suite, Wasabi, Sparrow, Guarda, Coinomi and Jaxx; and files under Desktop, Documents, Downloads and Projects matching mnemonic/seed/bip39/privatekey keywords plus.env,.npmrc,.netrc, id_rsa and ~/.aws material. Collected files are tarballed via the `tar` dependency and POSTed as a document to a hardcoded Telegram Bot API endpoint (https://api.telegram.org/bot\u003cBOT_TOKEN\u003e/sendDocument); the destination is not user-configurable. The package name and version carry no legitimate functionality that would justify this behavior.\n","modified":"2026-08-31T18:31:27.397894275Z","published":"2026-08-31T18:02:43Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["2.1.1"],"id":"IN-MAL-2026-019306","import_time":"2026-08-31T18:22:29.575846961Z","modified_time":"2026-08-31T18:02:43Z","sha256":"1b08920ddaa70b578792ec7097f9d47047bdfe436a44475ed8274037ce6d6386"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/test__123q2/v/2.1.1"}],"affected":[{"package":{"name":"test__123q2","ecosystem":"npm","purl":"pkg:npm/test__123q2"},"versions":["2.1.1"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test__123q2/MAL-2026-15638.json","indicators":{"evidence_files":[{"tlsh":"e513c66755ebe0180527f59aaf1f6006265c191b790cf94cbb9cca885fc93b891f23bc","path":"dist/script.js","sha256":"66b57d10b71c33dcb1617216f316a97309d945f7b159818a75573f4d09378c4b"}],"package_integrity":[{"filename":"test__123q2-2.1.1.tgz","hashes":{"sha512_sri":"sha512-uxciwcioRPPGbyz2d/aUpZF6qd2wMabqSsIZzwkBWO+ytrgVcP1QVl/XU2p4o3PEUPN5dZz8T2BiYNXsI6Gbng==","sha1":"d78ee632879a0393e2aa6550dfb8469806d47282"}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}