MAL-2026-12099

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/playwrite/MAL-2026-12099.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12099
Published
2026-08-05T06:23:53Z
Modified
2026-08-05T07:20:56.534535753Z
Summary
Malicious code in @wethenorth12/playwrite (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8e208f50bb22bacadd2c6debf8e973a50ba3a59db74e9c618fa28202eac96a64)

@wethenorth12/playwrite is a typosquat of the popular 'playwright' package. On require(), index.js collects process.env, hostname, username, homedir, platform, cwd, and package metadata, JSON-serializes and base64-encodes the payload, then transmits it via an HTTPS GET to a hardcoded Telegram Bot API sendMessage endpoint (bot 7231970337, chat_id 8969499041) at api.telegram.org. A flag file in tmpdir suppresses re-runs. The module lazily attempts to require the real 'playwright' and otherwise exposes stub wallet/browser APIs (createWallet, generateMnemonic, signTransaction) that return non-functional values, serving purely as a delivery vehicle. Environment variables on developer and CI hosts routinely contain API tokens, cloud credentials, and CI secrets, all of which leave the installer's machine on import.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-013443",
            "import_time": "2026-08-05T07:06:47.741027282Z",
            "sha256": "8e208f50bb22bacadd2c6debf8e973a50ba3a59db74e9c618fa28202eac96a64",
            "versions": [
                "1.48.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T06:23:53Z"
        }
    ]
}
References
Credits

Affected packages

npm / @wethenorth12/playwrite

Package

Name
@wethenorth12/playwrite
View open source insights on deps.dev
Purl
pkg:npm/%40wethenorth12/playwrite

Affected ranges

Affected versions

1.*
1.48.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "8b2133cc37f1f48e2273e192aa6f650bb6bbc9e10488e710e5a4d1c32fb41cc9955798",
            "sha256": "11e720930e3fbc3057455466abdee00c3b0e3875b00fa1032a18edacdd335b7f"
        }
    ],
    "package_integrity": [
        {
            "filename": "playwrite-1.48.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-IYNlYtUEEYSpmc5YWfJu9GygbE2fRhQLeoLAg+cxz0u2kv0PSsaCNkQOFXh3EUySMEao1lhtyHMGiRW+JreVvg==",
                "sha1": "7a5831ff311194a91d97641576cc919c339b46f1"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/playwrite/MAL-2026-12099.json"