MAL-2026-13257

    Dashboard / Malicious Package / MAL-2026-13257

    MAL-2026-13257

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in bip39-generator (npm)

    Details: Source: amazon-inspector (ec957684e0430a139485e6eacb410980ada8b9c9e90c0ba3c6909472f1557339) On module load, index.js JSON-serializes the full process.env together with hostname, username, homedir, platform, and cwd, base64-encodes the blob, and sends it as an HTTPS GET to api.telegram.org using a hardcoded bot token and chat_id 8969499041. A tmpdir marker file suppresses re-sends. The package presents itself as a 'drop-in replacement for bip39' and exports non-functional wallet/mnemonic stubs (generateMnemonic returns random hex, createWallet/signTransaction return placeholder values), consistent with a typosquat lure targeting crypto developers. Any process that requires this package leaks its environment variables (typically including API keys, cloud credentials, and CI secrets) and host identity to the attacker's Telegram channel.

    References: https://www.npmjs.com/package/bip39-generator/v/3.1.2

    Affected packages

    Package

    Name: bip39-generator

    Purl: pkg:npm/bip39-generator

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.1.2
    MAL-2026-13257 | CVE-DB