MAL-2026-12087

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/bitcoin-lib/MAL-2026-12087.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12087
Published
2026-08-05T06:25:08Z
Modified
2026-08-05T07:20:50.650053210Z
Summary
Malicious code in @wethenorth12/bitcoin-lib (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (34ac8cc76bddd60e41e530c9bb7cc74d902d3cb21a551db409bfdcac50a99cb8)

On require(), index.js reads the entire process.env plus host identifiers (hostname, username, homedir, platform, cwd, timestamp), JSON-stringifies and base64-encodes the payload, and issues an HTTPS GET to a hardcoded Telegram Bot API endpoint (api.telegram.org bot 7231970337, chat_id 8969499041). A tmpdir flag file gates one send per host. The package name typosquats bitcoinjs-lib and exposes stub generateMnemonic/createWallet/signTransaction functions that return junk values (generateMnemonic returns raw random bytes rather than a valid BIP-39 mnemonic), silently substituting fake wallet primitives when the real bitcoinjs-lib is not resolvable. Environment variables on developer and CI hosts routinely contain AWS keys, npm publish tokens, and other credentials; wholesale env exfil to an attacker-controlled Telegram bot on import constitutes credential theft against the installer, and the wallet-stub swap creates additional downstream cryptocurrency-key compromise for any consumer that relies on the drop-in claim.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-013451",
            "import_time": "2026-08-05T07:06:48.130766356Z",
            "sha256": "34ac8cc76bddd60e41e530c9bb7cc74d902d3cb21a551db409bfdcac50a99cb8",
            "versions": [
                "6.1.7"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T06:25:08Z"
        }
    ]
}
References
Credits

Affected packages

npm / @wethenorth12/bitcoin-lib

Package

Name
@wethenorth12/bitcoin-lib
View open source insights on deps.dev
Purl
pkg:npm/%40wethenorth12/bitcoin-lib

Affected ranges

Affected versions

6.*
6.1.7

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "4a2144c827b1f88e23726592643f610ab2abcae20848f751d5a9d1c72f741c889657cc",
            "sha256": "b1dd78dd96c7e7a5beef3e123cefa214464d4640ebe983055e47ea2bab8eea00"
        }
    ],
    "package_integrity": [
        {
            "filename": "bitcoin-lib-6.1.7.tgz",
            "hashes": {
                "sha512_sri": "sha512-WX4hAdJXzvYz82mrKueASUSd92bhUvh+q5pAwnZjFKybSxXMF3haLNUAPufRIMtNhuRIrtTgjgVu/fq/4e1FFg==",
                "sha1": "f797188d3956aa9f7933498054b6846b3c0533f2"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/bitcoin-lib/MAL-2026-12087.json"