{"id":"MAL-2026-15871","summary":"Malicious code in wallet-watcher (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113)\nOn npm install, the package's postinstall hook (src/scan.cjs) walks the installer's project tree starting three directories above node_modules and scans.env,.js,.ts,.json,.py,.yml, and keystore files for BIP-39 mnemonics, 0x-prefixed 64-hex private keys, and assignments matching secret/api_key/mnemonic patterns. Matches are AES-256-GCM encrypted with a hardcoded 32-byte key (KEY_B64 = 'Kkb8JVtVelmQmot/kC3JyY3WbjKH+LPln11DJ+bbTM0=') and POSTed to https://pkg-delivery-collector.vernal-dabs-tools.workers.dev/ingest along with a sha256(hostname|username)-derived host fingerprint and the package name. The main ESM entry's getBalances() also dynamically imports scan.cjs and re-invokes scanAndReport(path.resolve()) on every call, ensuring the same harvest fires against the caller's working directory at runtime even when postinstall was skipped via --ignore-scripts. Client-side AES-GCM encryption with an author-held key conceals the exfiltrated content from on-wire inspection.\n","modified":"2026-09-04T03:30:05.074099644Z","published":"2026-09-04T02:58:19Z","database_specific":{"malicious-packages-origins":[{"sha256":"5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113","source":"amazon-inspector","versions":["1.0.2"],"id":"IN-MAL-2026-019445","import_time":"2026-09-04T03:21:35.8695044Z","modified_time":"2026-09-04T02:58:19Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/wallet-watcher/v/1.0.2"}],"affected":[{"package":{"name":"wallet-watcher","ecosystem":"npm","purl":"pkg:npm/wallet-watcher"},"versions":["1.0.2"],"database_specific":{"indicators":{"package_integrity":[{"filename":"wallet-watcher-1.0.2.tgz","hashes":{"sha1":"1200899e7b3087aa53a6323a9800166bb0d669fb","sha512_sri":"sha512-nyCIaPizXSkFhSFozqJaesYz/IcmZzja72MwUX9Xz5TV5Xpjw8mX6I+sFdx12YPhNGxptfY7CXjp3Gxd37H3qQ=="}}],"evidence_files":[{"path":"src/scan.cjs","sha256":"6182efa6dc6149deb6598128becdfac81c57b212ae989fec51e3cd4e45361f7d","tlsh":"9a723b7d39ec647795d732a598470563a72240b22602a831f16c7b0d1f4d42ac32bffd"},{"path":"src/index.js","sha256":"ed4b9baa95587991bc25aeba839dfba74ecef4feb062dd71d4dc1e1893002567","tlsh":"035165f744f72224076a24da205f20167227918bf94ed44a73dd55404fae176eae2bce"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/wallet-watcher/MAL-2026-15871.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}