MAL-2026-12120

    Dashboard / Malicious Package / MAL-2026-12120

    MAL-2026-12120

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in @zzzgenesis00/env-loader (npm)

    Details: Source: amazon-inspector (cfbfc9bcbea1e1b9d6c52e2585bf5b28064fe8e38fe53304450fe1fd19340f3b) On npm install, postinstall.js reads installer-owned secret material — ~/.ssh entries, ~/.npmrc, ~/.gitconfig — and iterates a curated list of credential and wallet environment variables (NPM_TOKEN, GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY, PRIVATE_KEY, MNEMONIC, SEED_PHRASE, ETHEREUM/BITCOIN/SOLANA/TRON_PRIVATE_KEY, WALLET_PRIVATE_KEY, API_KEY, etc.), enumerates Chrome/Firefox profile artifacts (Cookies, Login Data) and wallet directories, and runs `npm whoami` and `git config user.email` to identify the host. The collected payload is JSON-encoded and transmitted to two hardcoded, attacker-controlled destinations: a Telegram Bot API endpoint (api.telegram.org/bot<redacted>/sendMessage) and an HTTP POST to 40f955f39128bd79-178-249-214-24.servousercontent.com/collect. The package presents itself as a dotenv alternative and exports a stub wallet API (generateMnemonic, createWallet, signTransaction returning random bytes) as a cover story; the block-worthy behavior is the install-time credential theft in postinstall.js.

    References: https://www.npmjs.com/package/@zzzgenesis00/env-loader/v/4.2.0

    Affected packages

    Package

    Name: @zzzgenesis00/env-loader

    Purl: pkg:npm/%40zzzgenesis00/env-loader

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    4.2.0