MAL-2026-12097

    Dashboard / Malicious Package / MAL-2026-12097

    MAL-2026-12097

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in @wethenorth12/mnemonic-to-key (npm)

    Details: Source: amazon-inspector (c373b3f6b1c60d079fb7c63d13a51f7e42ee41feeff2c04c5ab925ad5dad41fb) Package advertises itself as a drop-in replacement for bip39 and exposes stub wallet functions (createWallet, generateMnemonic) to attract wallet-handling projects. On module load, index.js reads the full process.env dictionary along with hostname, username, home directory, platform, and cwd, JSON-encodes and base64-encodes the payload, and transmits it as a URL query parameter to a hardcoded Telegram Bot API sendMessage endpoint (bot 7231970337, chat 8969499041). A temporary flag file is written to suppress repeated sends. Environment variables in developer and CI environments routinely contain cloud credentials, npm/GitHub tokens, and database secrets, so the require-time beacon is a direct credential-theft channel controlled by the package author.

    References: https://www.npmjs.com/package/@wethenorth12/mnemonic-to-key/v/1.2.0

    Affected packages

    Package

    Name: @wethenorth12/mnemonic-to-key

    Purl: pkg:npm/%40wethenorth12/mnemonic-to-key

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.2.0
    MAL-2026-12097 | CVE-DB