MAL-2026-11994

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/web3-provider-engine/MAL-2026-11994.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11994
Published
2026-08-04T23:52:49Z
Modified
2026-08-05T00:37:45.573314922Z
Summary
Malicious code in @zzzgenesis00/web3-provider-engine (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fae571005ccdcdc23e50fbee1eddc31d39355706b7945df3ccbb3096ecaf724b)

Package impersonates MetaMask's web3-provider-engine (author field 'MetaMask', homepage pointing to github.com/MetaMask/web3-provider-engine) while shipping a postinstall.js that runs automatically on npm install and harvests installer secrets. postinstall.js reads ~/.ssh contents, ~/.npmrc, ~/.gitconfig, Chrome/Firefox profile databases (Cookies, Login Data, key4.db), enumerates crypto wallet directories (.bitcoin,.ethereum,.metamask,.exodus, and others), invokes npm whoami and git config, and captures roughly 30 credential-shaped environment variables including NPMTOKEN, GITHUBTOKEN, AWS keys, PRIVATEKEY, MNEMONIC, SEEDPHRASE, and multiple chain-specific *PRIVATEKEY values. The collected data is JSON-serialized and transmitted to two hardcoded non-first-party destinations: api.telegram.org/bot<token>/sendMessage via GET with a hardcoded bot token and chat_id, and https://40f955f39128bd79-178-249-214-24.serveousercontent.com/collect via POST. index.js provides a stub web3 API surface (createWallet, generateMnemonic returning random bytes) to appear functional and disguise the harvest.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "16.0.5"
            ],
            "id": "IN-MAL-2026-011353",
            "import_time": "2026-08-05T00:04:38.126621737Z",
            "modified_time": "2026-08-04T23:52:49Z",
            "source": "amazon-inspector",
            "sha256": "fae571005ccdcdc23e50fbee1eddc31d39355706b7945df3ccbb3096ecaf724b"
        }
    ]
}
References
Credits

Affected packages

npm / @zzzgenesis00/web3-provider-engine

Package

Name
@zzzgenesis00/web3-provider-engine
View open source insights on deps.dev
Purl
pkg:npm/%40zzzgenesis00/web3-provider-engine

Affected ranges

Affected versions

16.*
16.0.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "web3-provider-engine-16.0.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-gX5ubmn2CEaLAmz4Uuo4okc09jOfo3WgZhPxpwXyJUa0Ya8tV2KQxu+WarDKbWfpaozimP2E/llEh2tIZYvsVg==",
                "sha1": "9e32129f0e21c3320694720ce8cbbd044af6ba9c"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "postinstall.js",
            "tlsh": "18d195a612e603195852b9ad87af00152633e1437838fbf87ecc5b514f4d52cdab2bb8",
            "sha256": "ce164f82a89b85c8a131a2a3ee3f2d3a2bb5654233d62db7c74b6d935c5a714e"
        },
        {
            "path": "package.json",
            "tlsh": "d2017635c4106e731ac81e84bc9a0ac3bb394e070804b81863c7016ceb4fa6725fd99d",
            "sha256": "6cc09802e9b683c55dae3c245c54271a6a3a40003d33694110376edb9bb66bb2"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/web3-provider-engine/MAL-2026-11994.json"