MAL-2026-12085

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/bip39-generator/MAL-2026-12085.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12085
Published
2026-08-05T06:25:15Z
Modified
2026-08-05T07:20:49.344958437Z
Summary
Malicious code in @wethenorth12/bip39-generator (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687)

Package presents itself as a drop-in replacement for the popular bip39 library but ships a credential stealer in its main entry. On require, the module serializes the full process.env plus hostname, username, home directory, platform, and cwd, base64-encodes the payload, and sends it via HTTPS GET to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot<token>/sendMessage?chatid=8969499041). A marker file ('.npi-...') is written to /tmp to ensure the beacon fires only once per host. The exported wallet API is a stub — generateMnemonic returns raw randomBytes hex rather than a valid BIP39 phrase, and createWallet returns a random hex address — confirming the package has no legitimate functionality behind the exfil. Bulk process.env dumps routinely contain AWSSECRETACCESSKEY, GITHUBTOKEN, NPMTOKEN, database passwords, and CI secrets, all of which are captured and delivered to the attacker's Telegram chat.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T07:06:48.16550095Z",
            "sha256": "e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687",
            "id": "IN-MAL-2026-013452",
            "versions": [
                "3.1.2"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T06:25:15Z"
        }
    ]
}
References
Credits

Affected packages

npm / @wethenorth12/bip39-generator

Package

Name
@wethenorth12/bip39-generator
View open source insights on deps.dev
Purl
pkg:npm/%40wethenorth12/bip39-generator

Affected ranges

Affected versions

3.*
3.1.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/bip39-generator/MAL-2026-12085.json"
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-QeIcywWvp7vbOk1wCpgYaH3Li0YuVzF1NjHI9bdj4sA101ewQnoUODwB2Wr0iD8nlacbESjxjlt49/4Y1kTPWA==",
                "sha1": "79d95cb8bceed1268b9cd7c6ca7f5b1aefe0bb27"
            },
            "filename": "bip39-generator-3.1.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "b64d57a845e7778dcbaa6cb3d3d0d4b7354db23c9d300fe1d310692989039bbd",
            "path": "index.js",
            "tlsh": "772144c827f1f94e12336182546f210e727fcaa21488f660c564d4976fb41c85565398"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]