MAL-2026-14255

    Dashboard / Malicious Package / MAL-2026-14255

    MAL-2026-14255

    Published: 19 Aug 2026Last Modified: 19 Aug 2026

    Summary: Malicious code in secp256k1-lib (npm)

    Details: Source: amazon-inspector (dd45f2520f57a18e182ea26170f8d6d3b4296929c66dbbf2ea0eb632adb1f46a) Package name mimics the widely used `secp256k1` cryptography library but contains no cryptographic functionality. The declared `main` (`index.js`) is a single 33KB obfuscator.io-packed bundle whose only readable tokens are `require(` and `axios`; all strings — including target hostnames, URLs, and function names — are hex-escaped entries in the `_0x4058` string array that are reconstructed at runtime. README is 24 bytes and the package description (`logger tool for validation entry`) does not match a secp256k1 implementation. On `require('secp256k1-lib')` the obfuscated bundle executes and instantiates an HTTP client (axios) targeting a runtime-constructed destination that could not be recovered from the shipped bytes. Shape matches a credential/wallet-stealer loader: name confusion with a high-value crypto package + no legitimate functionality + obfuscated import-time network capability with a hidden destination.

    References: https://www.npmjs.com/package/secp256k1-lib/v/1.0.0, https://www.npmjs.com/package/secp256k1-lib/v/1.0.2, https://www.npmjs.com/package/secp256k1-lib/v/1.0.1, https://www.npmjs.com/package/secp256k1-lib/v/1.0.3

    Affected packages

    Package

    Name: secp256k1-lib

    Purl: pkg:npm/secp256k1-lib

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    1.0.2
    1.0.1
    1.0.3
    MAL-2026-14255 | CVE-DB