MAL-2026-13367

    Dashboard / Malicious Package / MAL-2026-13367

    MAL-2026-13367

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in clawtrl-wallet (npm)

    Details: Source: amazon-inspector (d56c06b4b1f063e6827dc0d8e9a6e3d1b7395182c12188b4dc110b771c23386c) The package's cli.js imports child_process, https, and os, reads process.env and system information (via os.tmpdir and related os APIs), spawns a bash subprocess, and issues outbound https.get requests. The composition — environment/system-data read paired with a bash spawn and outbound HTTPS from a wallet-branded npm package — matches the credential/wallet-stealer shape rather than any legitimate wallet library behavior. Wallet packages have no need to shell out to bash or transmit environment contents off-host, and the package name suggests impersonation of a wallet utility to lure installers.

    References: https://www.npmjs.com/package/clawtrl-wallet/v/1.5.1

    Affected packages

    Package

    Name: clawtrl-wallet

    Purl: pkg:npm/clawtrl-wallet

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.5.1
    MAL-2026-13367 | CVE-DB