MAL-2026-12113

    Dashboard / Malicious Package / MAL-2026-12113

    MAL-2026-12113

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in python-bitcoinlib (npm)

    Details: Source: amazon-inspector (cfb9c83260c4fb83a678636e1e1c028f2aff3e3c0a0ac13728cfa2056a13389f) This npm package, published under the well-known PyPI name `python-bitcoinlib`, ships a `postinstall.js` lifecycle script that runs automatically on `npm install`. The script reads classic installer secret paths including `~/.ssh/id_rsa`, `~/.aws/credentials`, `~/.npmrc`, `.env` files, and Solana/Ethereum wallet keystores (`~/.config/solana/id.json`), and additionally walks dotdirs under $HOME for files whose names match wallet/key/secret/seed/mnemonic/keystore/private patterns. The collected file contents, together with `os.hostname()` and `os.userInfo()`, are POSTed via `https.request` to a hardcoded webhook.site collector at `https://webhook.site/5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4`. The package name collides with the established PyPI `python-bitcoinlib` project but ships unrelated code on npm, indicating deliberate ecosystem-confusion typosquatting rather than a legitimate port.

    References: https://www.npmjs.com/package/python-bitcoinlib/v/1.0.3, https://www.npmjs.com/package/python-bitcoinlib/v/1.0.1, https://www.npmjs.com/package/python-bitcoinlib/v/1.0.0, https://www.npmjs.com/package/python-bitcoinlib/v/1.0.2

    Affected packages

    Package

    Name: python-bitcoinlib

    Purl: pkg:npm/python-bitcoinlib

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.3
    1.0.1
    1.0.0
    1.0.2