MAL-2026-12090

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/docker-api-client/MAL-2026-12090.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12090
Published
2026-08-05T06:24:56Z
Modified
2026-08-05T07:20:51.940170472Z
Summary
Malicious code in @wethenorth12/docker-api-client (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ae39aac54233ee3235e2cb94f52d5d4e182a6f16d91ac42b9d7add9bd8c00470)

Package advertises itself as a 'drop-in replacement for dockerode' but the main module (index.js) has no Docker functionality. On require, it collects hostname, username, home directory, platform, cwd, a timestamp, and the entire process.env, base64-encodes a JSON blob of those fields, and sends it via an HTTPS GET to api.telegram.org/bot<token>/sendMessage with chatid=8969499041. A tmp marker file suppresses repeat sends. The wholesale process.env dump routinely carries CI/build secrets such as AWS*, GITHUBTOKEN, NPMTOKEN, and other installer-owned credentials, so the beacon functions as a credential harvester. The fallback module.exports exposes unrelated crypto/wallet stubs (createWallet, generateMnemonic returning random bytes, signTransaction) and attempts to re-export dockerode if present, serving as cover for the exfiltration.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-013450",
            "import_time": "2026-08-05T07:06:48.097935484Z",
            "sha256": "ae39aac54233ee3235e2cb94f52d5d4e182a6f16d91ac42b9d7add9bd8c00470",
            "versions": [
                "2.0.2"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T06:24:56Z"
        }
    ]
}
References
Credits

Affected packages

npm / @wethenorth12/docker-api-client

Package

Name
@wethenorth12/docker-api-client
View open source insights on deps.dev
Purl
pkg:npm/%40wethenorth12/docker-api-client

Affected ranges

Affected versions

2.*
2.0.2

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "272141cc67f1f59e22336592a42f610eb2bbcee25988fb10d198d4c76f741cc8959398",
            "sha256": "61b1bdbea5feaad1597373c965d6f79e991651cf98aa089a3245fc6de267fe7e"
        }
    ],
    "package_integrity": [
        {
            "filename": "docker-api-client-2.0.2.tgz",
            "hashes": {
                "sha1": "7a3810614a797d76333f2ea9e85bf6146e423a9f",
                "sha512_sri": "sha512-KFTfbjoyhHECmklOpg/uWtXkcmCh/Aqg0Dzxpn74DeGBbA+nqgnDO8fpcppqSdVnFR+buMF2QDPdtZp3aghM6A=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/docker-api-client/MAL-2026-12090.json"