MAL-2026-13345

    Dashboard / Malicious Package / MAL-2026-13345

    MAL-2026-13345

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in hd-key-generator (npm)

    Details: Source: amazon-inspector (3a102f1d05a0bd89af765e457c2b5d6121ec831d33549d0cbf9795d58b0d3ee6) hd-key-generator is a typosquat of the `hdkey` package. On require(), index.js reads process.env, os.hostname(), os.userInfo().username, the user's home directory, platform, cwd, and package metadata, JSON-serializes and base64-encodes the payload, then issues an HTTPS GET to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot<token>/sendMessage) with chat_id=8969499041. A tmp marker file is used to gate repeat sends. If the real `hdkey` package is present, it is re-exported to preserve apparent functionality; otherwise stub functions are returned. The full process.env dump captures any secrets the installer's shell or CI has exported (AWS_*, GITHUB_TOKEN, NPM_TOKEN, database credentials, and similar).

    References: https://www.npmjs.com/package/hd-key-generator/v/1.6.3

    Affected packages

    Package

    Name: hd-key-generator

    Purl: pkg:npm/hd-key-generator

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.6.3
    MAL-2026-13345 | CVE-DB