MAL-2026-12113

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/python-bitcoinlib/MAL-2026-12113.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12113
Published
2026-08-05T06:18:23Z
Modified
2026-08-05T07:21:24.336009883Z
Summary
Malicious code in python-bitcoinlib (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cfb9c83260c4fb83a678636e1e1c028f2aff3e3c0a0ac13728cfa2056a13389f)

This npm package, published under the well-known PyPI name python-bitcoinlib, ships a postinstall.js lifecycle script that runs automatically on npm install. The script reads classic installer secret paths including ~/.ssh/id_rsa, ~/.aws/credentials, ~/.npmrc, .env files, and Solana/Ethereum wallet keystores (~/.config/solana/id.json), and additionally walks dotdirs under $HOME for files whose names match wallet/key/secret/seed/mnemonic/keystore/private patterns. The collected file contents, together with os.hostname() and os.userInfo(), are POSTed via https.request to a hardcoded webhook.site collector at https://webhook.site/5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4. The package name collides with the established PyPI python-bitcoinlib project but ships unrelated code on npm, indicating deliberate ecosystem-confusion typosquatting rather than a legitimate port.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T06:18:23Z",
            "id": "IN-MAL-2026-013405",
            "import_time": "2026-08-05T07:06:45.92131259Z",
            "versions": [
                "1.0.3"
            ],
            "source": "amazon-inspector",
            "sha256": "0b40d55f884f1f26d7e0c5b6e21c5d2c3e419ae844f867b6b9cfc73d99f0dc4a"
        },
        {
            "versions": [
                "1.0.1"
            ],
            "id": "IN-MAL-2026-013414",
            "import_time": "2026-08-05T07:06:46.415512564Z",
            "modified_time": "2026-08-05T06:19:42Z",
            "source": "amazon-inspector",
            "sha256": "2feaa9ed505ac89313fee83925ae8c3364477c8a468d84810275c7532b92832a"
        },
        {
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-013426",
            "import_time": "2026-08-05T07:06:47.036834562Z",
            "modified_time": "2026-08-05T06:21:28Z",
            "source": "amazon-inspector",
            "sha256": "9e6e2d9915baad022b788cee95aed5c00113d2701ca0c690c25ec55016241555"
        },
        {
            "modified_time": "2026-08-05T06:18:33Z",
            "id": "IN-MAL-2026-013406",
            "import_time": "2026-08-05T07:06:46.038443933Z",
            "versions": [
                "1.0.2"
            ],
            "source": "amazon-inspector",
            "sha256": "cfb9c83260c4fb83a678636e1e1c028f2aff3e3c0a0ac13728cfa2056a13389f"
        }
    ]
}
References
Credits

Affected packages

npm / python-bitcoinlib

Package

Name
python-bitcoinlib
View open source insights on deps.dev
Purl
pkg:npm/python-bitcoinlib

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "python-bitcoinlib-1.0.3.tgz",
            "hashes": {
                "sha512_sri": "sha512-ZXi1PA1KAMt7tNexDttLOjBtRB8lcLCf90IUWqtpsYgTRlv1ivyJ6t3vcUYcTRGsHI1h6eIGYHEqWXXMG1/1gA==",
                "sha1": "6caa2ac25662de85e8387545afa6fe20fcfddb6e"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "152163d220f22721169b168a982a27006377a5672c0bdc807efc1b871f8dc550666bfc",
            "sha256": "e89f89726d0e20dccbae6ea5512d2b0a032b00f58a037976a384905e6e4d53b1"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/python-bitcoinlib/MAL-2026-12113.json"