MAL-2026-12106

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/web3-provider-engine/MAL-2026-12106.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12106
Published
2026-08-05T06:22:46Z
Modified
2026-08-05T07:20:59.349212925Z
Summary
Malicious code in @wethenorth12/web3-provider-engine (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0f54c89c6e669f4a9e1e2939e09b5ac809507f98df451e239add607d417f394a)

Package name mimics MetaMask's official web3-provider-engine and its README advertises a drop-in replacement, but the exported API (connect/createWallet/generateMnemonic) is a hollow stub — generateMnemonic returns crypto.randomBytes(32).toString('hex') rather than a valid BIP-39 mnemonic, silently producing non-functional wallets. On module load via the declared main (index.js), the package reads the entire process.env object together with hostname, username, home directory, platform, cwd, and package identifiers, base64-encodes the JSON payload, and sends it in an HTTPS GET to a hardcoded Telegram Bot API endpoint (api.telegram.org, bot ID 7231970337, chat_id 8969499041). A marker file (.npi-<random>) in the OS temp directory suppresses repeat sends per host. Bulk enumeration of process.env at import time harvests any secrets present in the installer's environment, including CI/CD tokens, cloud provider credentials, npm publish tokens, and database URLs.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-013435",
            "import_time": "2026-08-05T07:06:47.415012155Z",
            "sha256": "0f54c89c6e669f4a9e1e2939e09b5ac809507f98df451e239add607d417f394a",
            "versions": [
                "16.0.5"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T06:22:46Z"
        }
    ]
}
References
Credits

Affected packages

npm / @wethenorth12/web3-provider-engine

Package

Name
@wethenorth12/web3-provider-engine
View open source insights on deps.dev
Purl
pkg:npm/%40wethenorth12/web3-provider-engine

Affected ranges

Affected versions

16.*
16.0.5

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "f42196ad2bf1b44e12335991b86f260bb67fcba20484f620c1a5d1c37f301c84a557c8",
            "sha256": "0305f7089240d356edec86d841a4538ba38ecd0dc2cc27b4bb1783ae5072a580"
        }
    ],
    "package_integrity": [
        {
            "filename": "web3-provider-engine-16.0.5.tgz",
            "hashes": {
                "sha1": "eff0488c50d82cc99d1ff29db1d446933b9989e0",
                "sha512_sri": "sha512-Wm0glV2Q8L8uJa5Chcp1MYSzSI/HGtxoKYd6HPrsx/GHDsuva+1z8nTv5ol0QX81WyhG5I0tJPoqm6s/qh8IKQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@wethenorth12/web3-provider-engine/MAL-2026-12106.json"