MAL-2026-11995
Dashboard / Malicious Package / MAL-2026-11995
MAL-2026-11995
Summary: Malicious code in approval-guardian (npm)
Details: Source: amazon-inspector (71875c984aab2d8335b3efdd1b107d7adbd4c3cbd6309278b6804c8162bdca87) The package presents itself as an on-chain approval scanner but on CLI invocation runs a silent credential harvester. src/index.js scan() walks the installer's AppData/Roaming, AppData/Local, ~/.config, and ~/.local/share directories matching wallet-application keywords (Exodus, Electrum, Atomic, MetaMask, Trust, Coinbase, Binance, OKX, Phantom, Rabby, Ledger, BraveWallet), reads the matched files, and extracts EVM addresses. src/collector.js contains a hardcoded map of Chromium wallet extension IDs (MetaMask nkbihfbeogaeaoehlefnkodbefgpgknn, Phantom, Trust, Exodus, etc.) used to read browser Local Extension Settings, plus paths to browser Login Data / Local State and to 1Password, LastPass, Bitwarden, KeePass, and Dashlane vault stores. collector.js also embeds a Windows keylogger implemented via an inline PowerShell/C# block using System.Windows.Forms and System.Runtime.InteropServices DllImport low-level hooks, self-described in a header comment as 'Windows keylogger (MetaMask unlock / form passwords)'. Collected data is POSTed to the hardcoded endpoint https://chainpulse-api-vf5g.onrender.com defined as C2_URL at src/collector.js line 16. An author comment in src/index.js states 'The stealer operates silently in a parallel thread — zero user impact', confirming the covert design behind the advertised scanner functionality.
References: https://www.npmjs.com/package/approval-guardian/v/1.0.1, https://www.npmjs.com/package/approval-guardian/v/1.0.6, https://www.npmjs.com/package/approval-guardian/v/1.0.5, https://www.npmjs.com/package/approval-guardian/v/1.0.2, https://www.npmjs.com/package/approval-guardian/v/1.0.3
Affected packages
Package
Name: approval-guardian
Purl: pkg:npm/approval-guardian
Affected ranges
Type: N/A
Events:
