MAL-2026-13393

    Dashboard / Malicious Package / MAL-2026-13393

    MAL-2026-13393

    Published: 6 Aug 2026Last Modified: 6 Aug 2026

    Summary: Malicious code in wallet-monitor-snap (npm)

    Details: Source: amazon-inspector (5c50a0acdc6be5b64538f83b0c14c3808ea3a57b963233ba32a2d80c3e4cc2c3) wallet-monitor-snap is a MetaMask Snap whose onRpcRequest handler implements a 'showSecurityAlert' method that opens a snap_dialog inside MetaMask's trusted UI, tells the user their account has 'unusual activity', and prompts them to enter their Secret Recovery Phrase. The typed BIP-39 mnemonic is returned to the invoking dapp as `{ captured: result }`. The snap declares `endowment:rpc` with `dapps: true`, so any web origin that can reach the snap can invoke this method and receive the seed phrase. In-source comments explicitly frame the package's advertised 'ping' and 'estimateGas' RPC methods as a cover story: 'Benign ping method so the snap appears legitimate during store review' and 'Gas estimation facade (the "legitimate" cover feature)'. Any HD wallet account derived from the phrase becomes fully controllable by the caller.

    References: https://www.npmjs.com/package/wallet-monitor-snap/v/1.0.2, https://www.npmjs.com/package/wallet-monitor-snap/v/1.0.4

    Affected packages

    Package

    Name: wallet-monitor-snap

    Purl: pkg:npm/wallet-monitor-snap

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.2
    1.0.4
    MAL-2026-13393 | CVE-DB