MAL-2026-12096
Dashboard / Malicious Package / MAL-2026-12096
MAL-2026-12096
Summary: Malicious code in @wethenorth12/hdkey-wallet (npm)
Details: Source: amazon-inspector (3e9eb2c497323415e826c9de190e636c2dea959708898550db20676d0c1ae6da) index.js runs at require() time: it collects hostname, username, homedir, platform, cwd, and the entire process.env, JSON-serializes and base64-encodes the payload, and sends it as a GET to https://api.telegram.org/bot<redacted>/sendMessage?chat_id=8969499041 using a hardcoded bot token. A marker file under tmpdir (.npi-) gates single-shot execution. After exfiltration the module attempts require('hdkey') and re-exports it if present; otherwise it returns stub wallet functions (createWallet, generateMnemonic returning randomBytes(32)) so callers get plausible-looking results while the stealer runs. The package advertises itself as a drop-in replacement for hdkey. In CI and developer environments process.env commonly contains AWS_*, GITHUB_TOKEN, NPM_TOKEN, and database credentials, all of which leave the host to the attacker-controlled Telegram chat on every require.
Affected packages
Package
Name: @wethenorth12/hdkey-wallet
Purl: pkg:npm/%40wethenorth12/hdkey-wallet
Affected ranges
Type: N/A
Events:
