MAL-2026-12085

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/bip39-generator/MAL-2026-12085.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12085
Published
2026-08-05T06:25:15Z
Modified
2026-08-05T07:20:49Z
Summary
Malicious code in @wethenorth12/bip39-generator (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687)

Package presents itself as a drop-in replacement for the popular bip39 library but ships a credential stealer in its main entry. On require, the module serializes the full process.env plus hostname, username, home directory, platform, and cwd, base64-encodes the payload, and sends it via HTTPS GET to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot/sendMessage?chat_id=8969499041). A marker file ('.npi-...') is written to /tmp to ensure the beacon fires only once per host. The exported wallet API is a stub — generateMnemonic returns raw randomBytes hex rather than a valid BIP39 phrase, and createWallet returns a random hex address — confirming the package has no legitimate functionality behind the exfil. Bulk process.env dumps routinely contain AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, NPM_TOKEN, database passwords, and CI secrets, all of which are captured and delivered to the attacker's Telegram chat.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-013452",
            "import_time": "2026-08-05T07:06:48.16550095Z",
            "modified_time": "2026-08-05T06:25:15Z",
            "sha256": "e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687",
            "source": "amazon-inspector",
            "versions": [
                "3.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @wethenorth12/bip39-generator

Package

Name
@wethenorth12/bip39-generator
View open source insights on deps.dev
Purl
pkg:npm/%40wethenorth12/bip39-generator

Affected ranges

Affected versions

3.*
3.1.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "b64d57a845e7778dcbaa6cb3d3d0d4b7354db23c9d300fe1d310692989039bbd",
            "tlsh": "772144c827f1f94e12336182546f210e727fcaa21488f660c564d4976fb41c85565398"
        }
    ],
    "package_integrity": [
        {
            "filename": "bip39-generator-3.1.2.tgz",
            "hashes": {
                "sha1": "79d95cb8bceed1268b9cd7c6ca7f5b1aefe0bb27",
                "sha512_sri": "sha512-QeIcywWvp7vbOk1wCpgYaH3Li0YuVzF1NjHI9bdj4sA101ewQnoUODwB2Wr0iD8nlacbESjxjlt49/4Y1kTPWA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/bip39-generator/MAL-2026-12085.json"