MAL-2026-12095

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/hd-key-generator/MAL-2026-12095.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12095
Published
2026-08-05T06:23:30Z
Modified
2026-08-05T07:20:54.940727124Z
Summary
Malicious code in @wethenorth12/hd-key-generator (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0b2e832840746236ecbc71ba886ec793620dd508cd2a75eca04bd44e575cb03b)

@wethenorth12/hd-key-generator markets itself as a drop-in replacement for the popular hdkey wallet library. On require, index.js reads the full process.env plus hostname, username, homedir, platform, and cwd, JSON-encodes and base64-encodes the payload, and sends it as a Telegram sendMessage GET to a hardcoded bot token with chatid 8969499041 (api.telegram.org/bot<redacted>/sendMessage). A tmp marker file is written to suppress repeated sends. Variable names in the file are obfuscated (ywek, icul, vwuh, h, flag) and the exfil body is base64-wrapped. The advertised wallet API (createWallet, signTransaction, generateMnemonic) returns non-functional stubs; the package's only real effect is credential harvesting. In developer and CI environments, process.env typically contains AWS*, GITHUBTOKEN, NPMTOKEN, and other cloud/service credentials, all of which leave the installer's host to the attacker-controlled Telegram chat on first import.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-013440",
            "import_time": "2026-08-05T07:06:47.587640001Z",
            "sha256": "0b2e832840746236ecbc71ba886ec793620dd508cd2a75eca04bd44e575cb03b",
            "modified_time": "2026-08-05T06:23:30Z",
            "versions": [
                "1.6.3"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / @wethenorth12/hd-key-generator

Package

Name
@wethenorth12/hd-key-generator
View open source insights on deps.dev
Purl
pkg:npm/%40wethenorth12/hd-key-generator

Affected ranges

Affected versions

1.*
1.6.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-CT+Y30sr81xF1Lb0t9eaPVYA4TVfkpucmhfRaeMjnRPdC+KD3/0JqRB8ssggQ5Ir9AeGEpSvOr30DfWxCA8f9Q==",
                "sha1": "ed6c6a570e107461436362df5508b0730827d905"
            },
            "filename": "hd-key-generator-1.6.3.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "f8702540197ebac8dd4d30e085c94ecc54b6393cbe58c60efa80d93292d26dda",
            "tlsh": "d12166c827f1f89d2272a551646f650fb3bbcaa20888eb20c598c4c37f701c899657d8"
        },
        {
            "path": "README.md",
            "sha256": "28df9a7ac415c2ee0f4c77420c005e58865205bc85e3e708bea67b02d26878c2",
            "tlsh": "7cf09e3466613171605ba2cbfae360fa943680327210e578c9ee4c7ee153dca037f583"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/hd-key-generator/MAL-2026-12095.json"