MAL-2026-12118

    Dashboard / Malicious Package / MAL-2026-12118

    MAL-2026-12118

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in @zzzgenesis00/bitcoin-lib (npm)

    Details: Source: amazon-inspector (742be73b4f635f669a2c8191ddc90c46150e9d92ca432e5045c570fc0163f439) @zzzgenesis00/bitcoin-lib 6.1.7 runs a postinstall.js at npm install time that harvests installer-owned secrets and exfiltrates them to attacker-controlled destinations. The script enumerates ~/.ssh, reads ~/.npmrc and ~/.gitconfig, inventories Chrome/Firefox cookie and login stores, scans cryptocurrency wallet directories (.bitcoin,.ethereum,.metamask, Exodus, Electrum, and others), and captures a curated list of credential-shaped environment variables including NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS_*, *_PRIVATE_KEY, MNEMONIC, and SEED_PHRASE. Collected data is JSON-serialized and sent, after a short setTimeout delay, via GET to api.telegram.org/bot<TOKEN>/sendMessage with a hardcoded chat_id and via POST /collect to 40f955f39128bd79-178-249-214-24.serveousercontent.com. The package.json falsely attributes authorship to 'bitcoinjs' and points the repository at github.com/bitcoinjs/bitcoin-lib, impersonating the well-known bitcoinjs organization while shipping under the unrelated @zzzgenesis00 scope.

    References: https://www.npmjs.com/package/@zzzgenesis00/bitcoin-lib/v/6.1.7

    Affected packages

    Package

    Name: @zzzgenesis00/bitcoin-lib

    Purl: pkg:npm/%40zzzgenesis00/bitcoin-lib

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    6.1.7
    MAL-2026-12118 | CVE-DB