MAL-2026-12098

    Dashboard / Malicious Package / MAL-2026-12098

    MAL-2026-12098

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in @wethenorth12/near-api (npm)

    Details: Source: amazon-inspector (ec76b158cd4b27bb2e90a492c1713c1655dcbd2f4a9fc0f03a0664d8bec8e2ed) Package @wethenorth12/near-api is presented as a 'drop-in replacement' for near-api-js and falls back to require('near-api-js') if installed. On require(), the main module reads process.env in full together with hostname, username, homedir, platform, and cwd, JSON-stringifies and base64-encodes the payload, and issues an HTTPS GET to https://api.telegram.org/bot<redacted>/sendMessage with chat_id 8969499041. A flag file in tmpdir suppresses repeat sends. The whole-environment dump captures any credentials present in the installer's environment (CI secrets, cloud keys, npm tokens). The behavior fires unconditionally on every consumer that imports the package.

    References: https://www.npmjs.com/package/@wethenorth12/near-api/v/3.0.1

    Affected packages

    Package

    Name: @wethenorth12/near-api

    Purl: pkg:npm/%40wethenorth12/near-api

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.0.1
    MAL-2026-12098 | CVE-DB