MAL-2026-12067

    Dashboard / Malicious Package / MAL-2026-12067

    MAL-2026-12067

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in hwi-lib (npm)

    Details: Source: amazon-inspector (687b96d2fb386735a783701f54b1740fad0e16e1dc153ebcf7f07dd5506d23db) [email protected] ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads installer credential files (~/.aws/credentials, ~/.ssh/id_rsa, id_ed25519, id_ecdsa, ~/.npmrc, ~/.gitconfig, ~/.config/solana/id.json, ~/.ethereum/keystore,.env variants) and walks hidden subdirectories of the user's home directory reading any file matching wallet|key|secret|seed|mnemonic|keystore|private or ending in.json/.pem/.key. The collected contents are POSTed via https.request to the hardcoded endpoint https://enxhcjpo5ev.x.pipedream.net/c. Package name and 'crypto utility' description impersonate the HWI (Hardware Wallet Interface) tooling while the shipped module exports nothing, indicating a lure. Source: ossf-package-analysis (b354ab4fac90ce3cb0a5afb1a00d518a9a44e8a4da73e66845415e69ec620973) The OpenSSF Package Analysis project identified 'hwi-lib' @ 1.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

    References: https://www.npmjs.com/package/hwi-lib/v/1.0.1, https://www.npmjs.com/package/hwi-lib/v/1.0.2, https://www.npmjs.com/package/hwi-lib/v/1.0.0

    Affected packages

    Package

    Name: hwi-lib

    Purl: pkg:npm/hwi-lib

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    1.0.0
    1.0.2