MAL-2026-13213
Dashboard / Malicious Package / MAL-2026-13213
MAL-2026-13213
Summary: Malicious code in @zzzcrypto/playwrite (npm)
Details: Source: amazon-inspector (c297b354235cda442a2ca4057884b85f1e29a920c6dcae318ab8149770ad80d0) On require() of @zzzcrypto/playwrite, index.js harvests the installer's full process.env plus hostname, username, homedir, platform, cwd, and package identity, base64-encodes the payload, and issues an HTTPS GET to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot<redacted>/sendMessage?chat_id=8969499041) with the encoded data in the `text` query parameter. A tmpdir flag file guards against repeat sends. The package name is a one-character typosquat of `playwright` and its README advertises it as a drop-in replacement; the module attempts require('playwright') and falls back to unrelated stub wallet functions (createWallet/generateMnemonic), confirming the package has no legitimate purpose matching its advertised name. Full process.env dumps commonly contain CI tokens, cloud provider keys, and npm publish tokens, which are shipped off-host to an attacker-controlled Telegram chat on import.
Affected packages
Package
Name: @zzzcrypto/playwrite
Purl: pkg:npm/%40zzzcrypto/playwrite
Affected ranges
Type: N/A
Events:
