MAL-2026-12067

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hwi-lib/MAL-2026-12067.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12067
Published
2026-08-05T01:52:47Z
Modified
2026-08-05T07:21:15.656340136Z
Summary
Malicious code in hwi-lib (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (687b96d2fb386735a783701f54b1740fad0e16e1dc153ebcf7f07dd5506d23db)

hwi-lib@1.0.1 ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads installer credential files (~/.aws/credentials, ~/.ssh/idrsa, ided25519, id_ecdsa, ~/.npmrc, ~/.gitconfig, ~/.config/solana/id.json, ~/.ethereum/keystore,.env variants) and walks hidden subdirectories of the user's home directory reading any file matching wallet|key|secret|seed|mnemonic|keystore|private or ending in.json/.pem/.key. The collected contents are POSTed via https.request to the hardcoded endpoint https://enxhcjpo5ev.x.pipedream.net/c. Package name and 'crypto utility' description impersonate the HWI (Hardware Wallet Interface) tooling while the shipped module exports nothing, indicating a lure.

Source: ossf-package-analysis (b354ab4fac90ce3cb0a5afb1a00d518a9a44e8a4da73e66845415e69ec620973)

The OpenSSF Package Analysis project identified 'hwi-lib' @ 1.0.1 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "ossf-package-analysis",
            "import_time": "2026-08-05T03:11:11.787482564Z",
            "sha256": "b354ab4fac90ce3cb0a5afb1a00d518a9a44e8a4da73e66845415e69ec620973",
            "modified_time": "2026-08-05T01:52:47Z",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "versions": [
                "1.0.0"
            ],
            "sha256": "b384001368ca7ec877e30cd38551e5a8d27c7cb5802d745c8635e1988777ed6e",
            "import_time": "2026-08-05T03:11:12.140870321Z",
            "modified_time": "2026-08-05T02:07:43Z",
            "source": "ossf-package-analysis"
        },
        {
            "versions": [
                "1.0.1"
            ],
            "import_time": "2026-08-05T07:06:46.367556116Z",
            "sha256": "687b96d2fb386735a783701f54b1740fad0e16e1dc153ebcf7f07dd5506d23db",
            "id": "IN-MAL-2026-013413",
            "modified_time": "2026-08-05T06:19:35Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "1.0.2"
            ],
            "import_time": "2026-08-05T07:06:46.087225193Z",
            "sha256": "9811fc912ded9092f6b545a1e36c81b4f763c31fb141de0cb6c8fb22d4b6e54e",
            "id": "IN-MAL-2026-013407",
            "modified_time": "2026-08-05T06:18:40Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "1.0.0"
            ],
            "sha256": "f631ccb5df4527d7ed8233bbd74a7973d492949f7f547177aa057e126d3c365f",
            "import_time": "2026-08-05T07:06:47.174089355Z",
            "id": "IN-MAL-2026-013430",
            "modified_time": "2026-08-05T06:22:02Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / hwi-lib

Package

Name
hwi-lib
View open source insights on deps.dev
Purl
pkg:npm/hwi-lib

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "hwi-lib-1.0.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-NqBlbzZo7EHeA9QsSXPAtkgsP7gnoPH7X2WW1dxLdEW76gTHnCCrLQ6pHHUGRN4toDjIEDJHWvh5IKXFKtWnYA==",
                "sha1": "fa02df144587a41a0b18d0758240f10d746d1d9a"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "f54134d505df162154476bd8862b31107277e2d7344aa9c43e9c6b198f1d8384a5affc",
            "sha256": "cb89d25cb941a6c4f7b12d049518b8756e9a4ce84ddaedb89c225795487ca171",
            "path": "postinstall.js"
        },
        {
            "tlsh": "ffd02b101b5afa305fec8e995c3a886d049b2110808dc59d07f78078c2d679a880d41a",
            "sha256": "6f6fb7d0f867ee46ce122fe92a6fe1592266ee155310313ef858a4a5aca98aa3",
            "path": "package.json"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hwi-lib/MAL-2026-12067.json"