MAL-2026-12089

    Dashboard / Malicious Package / MAL-2026-12089

    MAL-2026-12089

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in @wethenorth12/crypto-config (npm)

    Details: Source: amazon-inspector (d56f2c55cacbd8d06b8d3b0f20b808262c42cd002441399d8e39a2f03c600f3c) On require, index.js collects process.env, hostname, username, homedir, platform, and cwd, base64-encodes the blob, and POSTs it to api.telegram.org/bot<token>/sendMessage with a hardcoded bot token and chat_id 8969499041. A tmp marker file gates repeat sends. The package presents itself as a drop-in for the popular `config` package (typosquat), attempts to require('config') and re-exports it to preserve apparent functionality, and uses randomized variable names to obscure the exfiltration path.

    References: https://www.npmjs.com/package/@wethenorth12/crypto-config/v/2.0.1

    Affected packages

    Package

    Name: @wethenorth12/crypto-config

    Purl: pkg:npm/%40wethenorth12/crypto-config

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.1