MAL-2026-12086

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/bip39-mnemonic/MAL-2026-12086.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12086
Published
2026-08-05T06:24:49Z
Modified
2026-08-05T07:20:50.524536826Z
Summary
Malicious code in @wethenorth12/bip39-mnemonic (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d0b607f30d6abb6d568a9a52ff027cea51c7a1efccc54c2fa59a8acc2d6f0386)

On require of the package's main entrypoint, the module collects hostname, username, home directory, platform, cwd, and the entire process.env, base64-encodes the JSON blob, and sends it as a Telegram sendMessage HTTP GET to a hardcoded bot token with chatid=8969499041 on api.telegram.org. A tmp flag file suppresses repeat sends. The bulk process.env dump routinely contains installer credentials (AWS*, NPMTOKEN, GHTOKEN, DB_PASSWORD, CI secrets), all of which are compromised on first import. The package additionally typosquats the legitimate bip39 library: package name, description, keywords and README ("Drop-in replacement for bip39") mimic it, and the author field is set to bitcoinjs-lib to impersonate an established maintainer. When the real bip39 is not present the package exposes a stub generateMnemonic/createWallet returning crypto.randomBytes(32).toString('hex') — non-standard mnemonic material that diverges from BIP-39 and would produce attacker-observable or non-recoverable wallet keys if used by downstream code.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-013449",
            "import_time": "2026-08-05T07:06:47.985333653Z",
            "sha256": "d0b607f30d6abb6d568a9a52ff027cea51c7a1efccc54c2fa59a8acc2d6f0386",
            "modified_time": "2026-08-05T06:24:49Z",
            "source": "amazon-inspector",
            "versions": [
                "2.3.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @wethenorth12/bip39-mnemonic

Package

Name
@wethenorth12/bip39-mnemonic
View open source insights on deps.dev
Purl
pkg:npm/%40wethenorth12/bip39-mnemonic

Affected ranges

Affected versions

2.*
2.3.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/bip39-mnemonic/MAL-2026-12086.json"
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "3e21668837f1f54d12336591a45f650bb2bfc6e20884ea50d168d5c32fb51c895a93f8",
            "sha256": "ec4517521407ede429afda1c2d8d9cefcd941098e4446acd143651f18361a0fc"
        },
        {
            "path": "package.json",
            "tlsh": "f7f04ca0d918593306f81f909c662452735a0c8f4c04bc1e23eb511e47cf46755fd23c",
            "sha256": "2921d2552c5a86b7eed3e84ca6563ce7231a40fdce77a127897b7623df7c6e47"
        }
    ],
    "package_integrity": [
        {
            "filename": "bip39-mnemonic-2.3.1.tgz",
            "hashes": {
                "sha1": "df8abe8eb791f05453713ea3660ee639b2da4a58",
                "sha512_sri": "sha512-LkuU9o4BY9RsyHNCy/3qacso0oxHKgj2Y5nSplXOIqS3WO/XS9KIAi7UMlQSY9sSWGOaTkD7aOH22csmsvwyvQ=="
            }
        }
    ]
}