MAL-2026-12109

    Dashboard / Malicious Package / MAL-2026-12109

    MAL-2026-12109

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in bip32-js (npm)

    Details: Source: amazon-inspector (115345055f99da651c7816286c6b076dbacdd2b659f466dded1a541b289e8c2d) bip32-js is a typosquat of the legitimate bip32 crypto library. Its index.js is an empty stub (module.exports = {}); the package's only functional code is a postinstall hook that runs automatically on npm install. The hook reads classic installer-owned secret paths —.env files, ~/.npmrc, ~/.aws/credentials, ~/.aws/config, ~/.ssh/id_rsa, id_ed25519, id_ecdsa, Solana ~/.config/solana/id.json, Ethereum keystores, and ~/.gitconfig — and additionally scans hidden home subdirectories for files matching wallet, seed, mnemonic, key, and keystore patterns. It packages the collected file contents together with os.hostname(), os.userInfo().username, and a timestamp, and POSTs the JSON body via https.request to the hardcoded endpoint https://enxhcjpo5ev.x.pipedream.net/c, an author-controlled Pipedream request-bin. The package.json also declares a suspicious dependency entry "self":"" alongside a wildcard pin on the real bip32 package.

    References: https://www.npmjs.com/package/bip32-js/v/1.0.1, https://www.npmjs.com/package/bip32-js/v/1.0.2, https://www.npmjs.com/package/bip32-js/v/1.0.0

    Affected packages

    Package

    Name: bip32-js

    Purl: pkg:npm/bip32-js

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    1.0.2
    1.0.0