MAL-2026-12056

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/mnemonic-to-key/MAL-2026-12056.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12056
Published
2026-08-05T02:52:23Z
Modified
2026-08-05T03:20:44.634356902Z
Summary
Malicious code in @zzzgenesis00/mnemonic-to-key (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c3af286f89deaee9dcce3d85f9bd53bc2b03e63dccf0073c74988b3f3a3763e8)

On npm install, postinstall.js executes and enumerates installer-side secrets: files under ~/.ssh (non-.pub private keys), ~/.npmrc, ~/.gitconfig, Chrome/Chromium/Firefox profile stores (Cookies, Login Data, key4.db), and cryptocurrency wallet directories (.bitcoin,.ethereum,.solana,.metamask,.exodus,.electrum, and similar). It also runs npm whoami and git config user.email and reads a list of credential-shaped environment variables including NPMTOKEN, NODEAUTHTOKEN, GITHUBTOKEN, AWS keys, MNEMONIC, SEEDPHRASE, ETHEREUMPRIVATEKEY, and WALLETPRIVATEKEY. The collected data is sent via HTTPS GET to api.telegram.org using a hardcoded bot token and chatid, with a backup POST to a hardcoded subdomain of serveousercontent.com at path /collect. The postinstall file is disguised with a module.exports = require('./index.js') passthrough and a header comment describing it as environment verification, and exfiltration is delayed with a randomized 1.5–3.5s timer to run after install output completes. Behavior is unrelated to the package's advertised mnemonic-to-key purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T03:12:04.702482241Z",
            "modified_time": "2026-08-05T02:52:23Z",
            "sha256": "c3af286f89deaee9dcce3d85f9bd53bc2b03e63dccf0073c74988b3f3a3763e8",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-011965",
            "versions": [
                "1.2.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @zzzgenesis00/mnemonic-to-key

Package

Name
@zzzgenesis00/mnemonic-to-key
View open source insights on deps.dev
Purl
pkg:npm/%40zzzgenesis00/mnemonic-to-key

Affected ranges

Affected versions

1.*
1.2.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "mnemonic-to-key-1.2.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-/NboJPx+Lwk6x0/VzaTjgo/eCTurRJbE4xB3dgRDpgk3mCINMomzH6jw6pjLvRDOFhFn35YxgA+g7uh6L/i7Lw==",
                "sha1": "1eeda8b9d6113d6c4c626f34c398e1dfc5330263"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "bdd1539612f607195892e9ae8b8f00241636d5073c20faf87edc47b16f4f52c9af57b8",
            "sha256": "2e46ba2d0c5f4518044dcf9e12a0f277efd12f3173956cf42184d082c3dc0a8c",
            "path": "postinstall.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/mnemonic-to-key/MAL-2026-12056.json"