MAL-2026-12118

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/bitcoin-lib/MAL-2026-12118.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12118
Published
2026-08-05T08:43:51Z
Modified
2026-08-05T10:05:37.626573137Z
Summary
Malicious code in @zzzgenesis00/bitcoin-lib (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (742be73b4f635f669a2c8191ddc90c46150e9d92ca432e5045c570fc0163f439)

@zzzgenesis00/bitcoin-lib 6.1.7 runs a postinstall.js at npm install time that harvests installer-owned secrets and exfiltrates them to attacker-controlled destinations. The script enumerates ~/.ssh, reads ~/.npmrc and ~/.gitconfig, inventories Chrome/Firefox cookie and login stores, scans cryptocurrency wallet directories (.bitcoin,.ethereum,.metamask, Exodus, Electrum, and others), and captures a curated list of credential-shaped environment variables including NPMTOKEN, NODEAUTHTOKEN, GITHUBTOKEN, AWS_*, *PRIVATEKEY, MNEMONIC, and SEEDPHRASE. Collected data is JSON-serialized and sent, after a short setTimeout delay, via GET to api.telegram.org/bot<TOKEN>/sendMessage with a hardcoded chatid and via POST /collect to 40f955f39128bd79-178-249-214-24.serveousercontent.com. The package.json falsely attributes authorship to 'bitcoinjs' and points the repository at github.com/bitcoinjs/bitcoin-lib, impersonating the well-known bitcoinjs organization while shipping under the unrelated @zzzgenesis00 scope.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014393",
            "import_time": "2026-08-05T09:28:05.804335414Z",
            "sha256": "742be73b4f635f669a2c8191ddc90c46150e9d92ca432e5045c570fc0163f439",
            "versions": [
                "6.1.7"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:43:51Z"
        }
    ]
}
References
Credits

Affected packages

npm / @zzzgenesis00/bitcoin-lib

Package

Name
@zzzgenesis00/bitcoin-lib
View open source insights on deps.dev
Purl
pkg:npm/%40zzzgenesis00/bitcoin-lib

Affected ranges

Affected versions

6.*
6.1.7

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "tlsh": "6ed1539212e613186893e9af4b8f00141632d1473814fff53ecd57564f4e56c9bf6ba8",
            "sha256": "eddbc21f7d2e50e6e35f4d1e3a526603bdf7ff6ec84a2a9dce677e4839aa22b5"
        },
        {
            "path": "package.json",
            "tlsh": "850149a0d9601d332be82a816c2a418b76229c8f4c04bc2a33e7411c4f5d0bf1dfd12c",
            "sha256": "07c26bc6f2e65528ae3309d84a21667bf10935106e73cec2c89b9f140fa35ade"
        }
    ],
    "package_integrity": [
        {
            "filename": "bitcoin-lib-6.1.7.tgz",
            "hashes": {
                "sha1": "32f2c773ab92b6c9d3975aeb940c664dcf42506e",
                "sha512_sri": "sha512-e3cRryjlWvmJLrfjAZGgDI0cuT2xPjzc9h5x0SyBKJD6fQvnaaxp6dSsNpiQs405oWTkigTirt9yCd6j3mL7PQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/bitcoin-lib/MAL-2026-12118.json"