MAL-2026-12090

    Dashboard / Malicious Package / MAL-2026-12090

    MAL-2026-12090

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in @wethenorth12/docker-api-client (npm)

    Details: Source: amazon-inspector (ae39aac54233ee3235e2cb94f52d5d4e182a6f16d91ac42b9d7add9bd8c00470) Package advertises itself as a 'drop-in replacement for dockerode' but the main module (index.js) has no Docker functionality. On require, it collects hostname, username, home directory, platform, cwd, a timestamp, and the entire process.env, base64-encodes a JSON blob of those fields, and sends it via an HTTPS GET to api.telegram.org/bot<token>/sendMessage with chat_id=8969499041. A tmp marker file suppresses repeat sends. The wholesale process.env dump routinely carries CI/build secrets such as AWS_*, GITHUB_TOKEN, NPM_TOKEN, and other installer-owned credentials, so the beacon functions as a credential harvester. The fallback module.exports exposes unrelated crypto/wallet stubs (createWallet, generateMnemonic returning random bytes, signTransaction) and attempts to re-export dockerode if present, serving as cover for the exfiltration.

    References: https://www.npmjs.com/package/@wethenorth12/docker-api-client/v/2.0.2

    Affected packages

    Package

    Name: @wethenorth12/docker-api-client

    Purl: pkg:npm/%40wethenorth12/docker-api-client

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.2
    MAL-2026-12090 | CVE-DB