MAL-2026-11529

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/crypto-config/MAL-2026-11529.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-11529

Published

2026-08-04T22:08:55Z

Modified

2026-08-04T23:04:45Z

Summary

Malicious code in @zzzgenesis00/crypto-config (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0059f996b08ee001bad27a2ec933573651b171f5b4fcde2b1e12b7a4388c7ca3)

postinstall.js runs automatically on npm install and enumerates installer-owned secret material: SSH private keys under ~/.ssh, ~/.npmrc, ~/.gitconfig, Chrome/Firefox profile cookie/login/key databases, cryptocurrency wallet directories (metamask, exodus, electrum, etc.), and a curated list of sensitive environment variables including NPM_TOKEN, AWS keys, GitHub tokens, ETHEREUM_PRIVATE_KEY, and MNEMONIC. It also invokes npm whoami and git config user.email to bind the exfil to a specific identity. The collected profile is sent via HTTPS GET to api.telegram.org using a hardcoded bot token and chat_id, and via HTTPS POST to a hardcoded serveousercontent.com tunnel endpoint at /collect; neither destination is caller-configurable. Delivery is jittered via setTimeout(1500 + Math.random()*2000) and identifiers throughout the script are mangled (_vaa, _zmj, _rlb, _cp, _ht, _tk, _ch, _co, _ex). The package name, author field (lorenwest, the maintainer of the legitimate config package), and homepage impersonate a benign configuration library, and index.js transparently proxies to the real config package when present as a cover for the install-time payload.

Database specific

{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-011351",
            "import_time": "2026-08-04T22:30:12.15145706Z",
            "modified_time": "2026-08-04T22:08:55Z",
            "sha256": "0059f996b08ee001bad27a2ec933573651b171f5b4fcde2b1e12b7a4388c7ca3",
            "source": "amazon-inspector",
            "versions": [
                "2.0.1"
            ]
        }
    ]
}

References

https://www.npmjs.com/package/@zzzgenesis00/crypto-config/v/2.0.1

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / @zzzgenesis00/crypto-config

Package

Name: @zzzgenesis00/crypto-config; View open source insights on deps.dev
Purl: pkg:npm/%40zzzgenesis00/crypto-config

Affected ranges

Affected versions

2.*

2.0.1

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "46461df621855061727a1d7b05bee479bcfa5160a14919b50f7f9b3a12b77633",
            "tlsh": "26d1849752e603696896b9ae4b5f50241633e2033c20fbf57ece0b510f4e12c9af57a9"
        }
    ],
    "package_integrity": [
        {
            "filename": "crypto-config-2.0.1.tgz",
            "hashes": {
                "sha1": "94ce11b3b5976ad317707b2a3726c788b468e869",
                "sha512_sri": "sha512-M0as15cjWVnw34zhS/3jRoQsQsMXo74w4yYzhxdkVAM8mBo6puxl0rikd2b9ybHHXDdE5aBGtt4E5Id9jcxZhw=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/crypto-config/MAL-2026-11529.json"