MAL-2026-12095
Dashboard / Malicious Package / MAL-2026-12095
MAL-2026-12095
Summary: Malicious code in @wethenorth12/hd-key-generator (npm)
Details: Source: amazon-inspector (0b2e832840746236ecbc71ba886ec793620dd508cd2a75eca04bd44e575cb03b) @wethenorth12/hd-key-generator markets itself as a drop-in replacement for the popular `hdkey` wallet library. On require, index.js reads the full process.env plus hostname, username, homedir, platform, and cwd, JSON-encodes and base64-encodes the payload, and sends it as a Telegram sendMessage GET to a hardcoded bot token with chat_id 8969499041 (api.telegram.org/bot<redacted>/sendMessage). A tmp marker file is written to suppress repeated sends. Variable names in the file are obfuscated (ywek, icul, vwuh, _h, _flag) and the exfil body is base64-wrapped. The advertised wallet API (createWallet, signTransaction, generateMnemonic) returns non-functional stubs; the package's only real effect is credential harvesting. In developer and CI environments, process.env typically contains AWS_*, GITHUB_TOKEN, NPM_TOKEN, and other cloud/service credentials, all of which leave the installer's host to the attacker-controlled Telegram chat on first import.
Affected packages
Package
Name: @wethenorth12/hd-key-generator
Purl: pkg:npm/%40wethenorth12/hd-key-generator
Affected ranges
Type: N/A
Events:
