MAL-2026-12112

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mnemonic-utils/MAL-2026-12112.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12112
Published
2026-08-05T06:18:00Z
Modified
2026-08-05T07:21:18.216190838Z
Summary
Malicious code in mnemonic-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dc209736a2c44e541e224030a4c0bd7145bb77a17fa66504cd96beedc75ce6f4)

index.js executes an IIFE at require-time that reads installer-owned secret files (.env,.npmrc, ~/.aws/credentials, ~/.ssh/idrsa, ided25519, id_ecdsa, Solana id.json, Ethereum keystore) and recursively scans home dotdirectories for files matching /wallet|key|secret|seed|mnemonic|keystore|private/. The harvested contents are combined with os.hostname() and os.userInfo().username into a single JSON body and POSTed over HTTPS to a hardcoded webhook.site URL (path /5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4). The payload is gated by a Date.UTC(2026,7,6) activation check, with in-source comments describing the delay as evasion of npm sandbox detection windows. The package name suggests a mnemonic utility, but the shipped code performs no such function — its only behavior is credential and wallet-secret exfiltration.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T06:18:08Z",
            "id": "IN-MAL-2026-013403",
            "import_time": "2026-08-05T07:06:45.804246772Z",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector",
            "sha256": "1fa35d474395d73750ae91e7fe420051657623e9a10c517cb06f184f23bc4310"
        },
        {
            "modified_time": "2026-08-05T06:18:00Z",
            "id": "IN-MAL-2026-013402",
            "import_time": "2026-08-05T07:06:45.758800806Z",
            "versions": [
                "1.0.2"
            ],
            "source": "amazon-inspector",
            "sha256": "dc209736a2c44e541e224030a4c0bd7145bb77a17fa66504cd96beedc75ce6f4"
        },
        {
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-013418",
            "import_time": "2026-08-05T07:06:46.663497335Z",
            "modified_time": "2026-08-05T06:20:19Z",
            "source": "amazon-inspector",
            "sha256": "2cbe05c633f1390b0beffc89dcd60b0ba64f78e9f6b2e32a9f428ac88a295c3e"
        }
    ]
}
References
Credits

Affected packages

npm / mnemonic-utils

Package

Name
mnemonic-utils
View open source insights on deps.dev
Purl
pkg:npm/mnemonic-utils

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "mnemonic-utils-1.0.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-edkJXoPz81Im7guXBW4WedNi7BG/ro6VxIFimjSqRODwJswuP7Z43Y7F7+rey8aH99fmhtRnBCh+sSYz61GVzg==",
                "sha1": "1797dee212fc833b81f2f21d45844d46e996673e"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "postinstall.js",
            "tlsh": "9e2130d200f59b65268a0a9ad8182700527769676c0aacc17efc6e874f888940e37bfc",
            "sha256": "720a192a5f8902b99c23e21e27f721d723c455d2302d30a186187189c8cb9288"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/mnemonic-utils/MAL-2026-12112.json"