MAL-2026-11534

    Dashboard / Malicious Package / MAL-2026-11534

    MAL-2026-11534

    Published: 4 Aug 2026Last Modified: 4 Aug 2026

    Summary: Malicious code in @zzzgenesis00/xrp-lib (npm)

    Details: Source: amazon-inspector (49ad59aa1c004d723d6e24f8113d8f3d45728c0b26fc41531ec00c0f91d2ddef) The package impersonates XRPLF's xrp-lib (author metadata and homepage point at github.com/XRPLF/xrp-lib) while being published under an unrelated scope. Its postinstall.js runs automatically on npm install and collects host metadata, iterates ~40 credential-shaped environment variables (NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS_*, MNEMONIC, SEED_PHRASE, ETHEREUM_PRIVATE_KEY, and similar), reads ~/.ssh, ~/.npmrc, and ~/.gitconfig, indexes Chrome/Firefox profile stores, runs `npm whoami` and `git config`, and enumerates wallet directories. The harvested profile is exfiltrated via two hardcoded non-first-party destinations: api.telegram.org using a hardcoded bot token and chat id, and https://40f955f39128bd79-178-249-214-24.serveousercontent.com/collect via POST. Identifiers are mangled (_uzy/_cod/_ndz/_cp/_ht/_tk/_ch), the payload is disguised with a 'postinstall environment verification' comment, and exfil is delayed via setTimeout with a 1.5–3.5s random jitter to hide from install traces.

    References: https://www.npmjs.com/package/@zzzgenesis00/xrp-lib/v/2.14.0

    Affected packages

    Package

    Name: @zzzgenesis00/xrp-lib

    Purl: pkg:npm/%40zzzgenesis00/xrp-lib

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.14.0
    MAL-2026-11534 | CVE-DB