MAL-2026-12087

    Dashboard / Malicious Package / MAL-2026-12087

    MAL-2026-12087

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in @wethenorth12/bitcoin-lib (npm)

    Details: Source: amazon-inspector (34ac8cc76bddd60e41e530c9bb7cc74d902d3cb21a551db409bfdcac50a99cb8) On require(), index.js reads the entire process.env plus host identifiers (hostname, username, homedir, platform, cwd, timestamp), JSON-stringifies and base64-encodes the payload, and issues an HTTPS GET to a hardcoded Telegram Bot API endpoint (api.telegram.org bot 7231970337, chat_id 8969499041). A tmpdir flag file gates one send per host. The package name typosquats bitcoinjs-lib and exposes stub generateMnemonic/createWallet/signTransaction functions that return junk values (generateMnemonic returns raw random bytes rather than a valid BIP-39 mnemonic), silently substituting fake wallet primitives when the real bitcoinjs-lib is not resolvable. Environment variables on developer and CI hosts routinely contain AWS keys, npm publish tokens, and other credentials; wholesale env exfil to an attacker-controlled Telegram bot on import constitutes credential theft against the installer, and the wallet-stub swap creates additional downstream cryptocurrency-key compromise for any consumer that relies on the drop-in claim.

    References: https://www.npmjs.com/package/@wethenorth12/bitcoin-lib/v/6.1.7

    Affected packages

    Package

    Name: @wethenorth12/bitcoin-lib

    Purl: pkg:npm/%40wethenorth12/bitcoin-lib

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    6.1.7
    MAL-2026-12087 | CVE-DB