MAL-2026-12096

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/hdkey-wallet/MAL-2026-12096.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12096
Published
2026-08-05T06:23:04Z
Modified
2026-08-05T07:20:54.951742141Z
Summary
Malicious code in @wethenorth12/hdkey-wallet (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3e9eb2c497323415e826c9de190e636c2dea959708898550db20676d0c1ae6da)

index.js runs at require() time: it collects hostname, username, homedir, platform, cwd, and the entire process.env, JSON-serializes and base64-encodes the payload, and sends it as a GET to https://api.telegram.org/bot<redacted>/sendMessage?chatid=8969499041 using a hardcoded bot token. A marker file under tmpdir (.npi-) gates single-shot execution. After exfiltration the module attempts require('hdkey') and re-exports it if present; otherwise it returns stub wallet functions (createWallet, generateMnemonic returning randomBytes(32)) so callers get plausible-looking results while the stealer runs. The package advertises itself as a drop-in replacement for hdkey. In CI and developer environments process.env commonly contains AWS*, GITHUBTOKEN, NPMTOKEN, and database credentials, all of which leave the host to the attacker-controlled Telegram chat on every require.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-013437",
            "import_time": "2026-08-05T07:06:47.48643046Z",
            "sha256": "3e9eb2c497323415e826c9de190e636c2dea959708898550db20676d0c1ae6da",
            "versions": [
                "2.1.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T06:23:04Z"
        }
    ]
}
References
Credits

Affected packages

npm / @wethenorth12/hdkey-wallet

Package

Name
@wethenorth12/hdkey-wallet
View open source insights on deps.dev
Purl
pkg:npm/%40wethenorth12/hdkey-wallet

Affected ranges

Affected versions

2.*
2.1.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "e02141cc27f1f98e123361d1656f750bb2bbcae24888ea60d1a4d5c32f741c89965398",
            "sha256": "0f8b5505e3627b2d23d7e45acb9e66b7959ab5b083a44c022e7e8f4e7c55fa78"
        }
    ],
    "package_integrity": [
        {
            "filename": "hdkey-wallet-2.1.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-M48XyqtWb+q8Mdy0VoiINgx8Os0AiZ0iFGSiKMUNw6bC6krF9I2pzKxUDVLbdbTphkdNQN4/cBVnkJJbLxLz1w==",
                "sha1": "0f58b72889edefe713be7245c63b20e7bb5864e7"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/hdkey-wallet/MAL-2026-12096.json"