MAL-2026-12078

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/trezor-lib/MAL-2026-12078.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12078
Published
2026-08-05T02:07:37Z
Modified
2026-08-05T07:21:35.276156534Z
Summary
Malicious code in trezor-lib (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (744ba5806b927aefbdd505acb44fb77a23bb71570d27d1ba17ec7642dcf17383)

trezor-lib@1.0.3 is a Trezor-lookalike npm package whose index.js, on first require(), harvests installer-side secrets and posts them to a hardcoded webhook.site inbox. The require-time payload reads $HOME/.env, ~/.npmrc, ~/.aws/credentials, ~/.ssh/idrsa, ~/.ssh/ided25519, ~/.ssh/id_ecdsa, ~/.config/solana/id.json, and ~/.ethereum/keystore, and enumerates dotfile directories for files matching wallet|key|secret|seed|mnemonic|keystore|private with.json/.pem extensions. The collected file contents are bundled with os.hostname() and os.userInfo().username into a JSON payload and sent via https.request to hostname webhook.site path /5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4. Execution is gated behind a Date.UTC(2026,7,6) activation timestamp with an in-source comment stating the delay is to avoid npm sandbox detection windows, so pre-activation-date installs see a no-op while real installers after that date trigger the harvester. The package name typosquats Trezor while its declared purpose is a generic utility library; the traced behavior is credential and wallet-secret theft, not any legitimate library function.

Source: ossf-package-analysis (d81bc24e9f56c5ca72558e331a2d0fae1d514c1c3fe26d275b5885c91a8a72f5)

The OpenSSF Package Analysis project identified 'trezor-lib' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T03:11:11.965231275Z",
            "modified_time": "2026-08-05T02:07:37Z",
            "sha256": "d81bc24e9f56c5ca72558e331a2d0fae1d514c1c3fe26d275b5885c91a8a72f5",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "import_time": "2026-08-05T07:06:47.075770828Z",
            "modified_time": "2026-08-05T06:21:36Z",
            "sha256": "0b822747067118a36f2ac26bf830e9fc8bbbdc26fa77216a4366184d40ae69c7",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-013427",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "import_time": "2026-08-05T07:06:45.88119522Z",
            "modified_time": "2026-08-05T06:18:16Z",
            "sha256": "5ed7fc8451b4d2196ad538dc1854d23504faab52e30eafa59c253e69bb5f2a67",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-013404",
            "versions": [
                "1.0.2"
            ]
        },
        {
            "import_time": "2026-08-05T07:06:46.857599012Z",
            "modified_time": "2026-08-05T06:20:48Z",
            "sha256": "6af4bb60075c729a6f582ea56179dc42fb9e5c89b73d0ef9cea1c38f3ae93fd3",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-013421",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "import_time": "2026-08-05T07:06:45.443800605Z",
            "modified_time": "2026-08-05T06:17:13Z",
            "sha256": "744ba5806b927aefbdd505acb44fb77a23bb71570d27d1ba17ec7642dcf17383",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-013397",
            "versions": [
                "1.0.3"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / trezor-lib

Package

Name
trezor-lib
View open source insights on deps.dev
Purl
pkg:npm/trezor-lib

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "trezor-lib-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-7z+z/W/nKR4ohx4lo7c3wFngmrnOWxoUrMkWGb8JoYsmzk9yL+qLgvSe/qPmya5HiUU4okzXwC8zX2KTvR2Qeg==",
                "sha1": "2f98ab95e05663b01db7b77b41a6c7a1564f59ce"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "153120e045e61630555736e8852b2200b173f29334469ec87acc5b118f1dc6846a7bfc",
            "sha256": "fe32f577c0be956d68eec04bf5a29f6cd3a3a495d638421ae4d9ef92f74f83c2",
            "path": "postinstall.js"
        },
        {
            "tlsh": "c1d02b102f12a67324d42f690923825936320c1e4185742d13f79054828f2b31afbb0e",
            "sha256": "060fbe5c94d48ecc2e5f4eca8cd98dfe0e1d518d8ee96a832aa2df16ac7bb57e",
            "path": "package.json"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/trezor-lib/MAL-2026-12078.json"