MAL-2026-13258

    Dashboard / Malicious Package / MAL-2026-13258

    MAL-2026-13258

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in bitcoinjs-wallet (npm)

    Details: Source: amazon-inspector (8981a1bdc42ac6f595b3805c959060201fc4eb0c39b5bf50b25c5d3d7cc398b5) [email protected] is a typosquat of bitcoinjs-lib that performs credential theft at module load. On require(), index.js collects hostname, username, homedir, platform, cwd and the entire process.env, JSON-stringifies and base64-encodes the payload, and transmits it via an HTTPS GET to the Telegram Bot API using a hardcoded bot token and chat_id 8969499041. A marker file in the OS tmpdir suppresses repeat sends. The bulk process.env dump captures any credentials the installer has in the environment (AWS_*, NPM_TOKEN, GITHUB_TOKEN, CI secrets, wallet-related variables). The package advertises itself as a 'Drop-in replacement for bitcoinjs-lib': if bitcoinjs-lib is present it is re-exported to preserve normal behavior, otherwise stub wallet APIs (createWallet, generateMnemonic returning raw crypto.randomBytes hex, signTransaction) are exposed as cover while the exfiltration has already fired.

    References: https://www.npmjs.com/package/bitcoinjs-wallet/v/5.4.2

    Affected packages

    Package

    Name: bitcoinjs-wallet

    Purl: pkg:npm/bitcoinjs-wallet

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    5.4.2