MAL-2026-12119

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/bitcoinjs-wallet/MAL-2026-12119.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12119
Published
2026-08-05T08:43:07Z
Modified
2026-08-05T10:05:37.909589963Z
Summary
Malicious code in @zzzgenesis00/bitcoinjs-wallet (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bcabff22bb09847474002e52ef9e8101a847fe662fcf18eec0617fd6e9829e20)

This package is a typosquat of the bitcoinjs-wallet ecosystem. Its index.js is a thin passthrough while the malicious behavior is in postinstall.js, which runs automatically on npm install. The postinstall script enumerates ~/.ssh, ~/.npmrc, ~/.gitconfig, Chrome/Chromium/Firefox profile paths (Cookies, Login Data, key4.db, logins.json), and a curated list of cryptocurrency wallet directories (.bitcoin,.ethereum,.metamask,.exodus,.electrum, and others). It also reads credential-shaped environment variables including NPMTOKEN, NODEAUTHTOKEN, GITHUBTOKEN, AWSSECRETACCESSKEY, PRIVATEKEY, MNEMONIC, SEEDPHRASE, and ETHEREUMPRIVATEKEY. It shells out to npm whoami and git config --global user.email via childprocess.execSync to tag the harvested data with the developer's identity. The collected profile is transmitted via two channels: a GET to api.telegram.org using a hardcoded bot token (7231970337) and chat_id, and a POST to /collect on the serveo tunnel host 40f955f39128bd79-178-249-214-24.serveousercontent.com. Exfiltration is delayed via setTimeout with a randomized 1500-3500 ms window and wrapped in an 'environment verification' cover-story comment to blend with normal install activity.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014388",
            "import_time": "2026-08-05T09:28:05.258920982Z",
            "sha256": "bcabff22bb09847474002e52ef9e8101a847fe662fcf18eec0617fd6e9829e20",
            "modified_time": "2026-08-05T08:43:07Z",
            "versions": [
                "5.4.2"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / @zzzgenesis00/bitcoinjs-wallet

Package

Name
@zzzgenesis00/bitcoinjs-wallet
View open source insights on deps.dev
Purl
pkg:npm/%40zzzgenesis00/bitcoinjs-wallet

Affected ranges

Affected versions

5.*
5.4.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-j518OOUmSfW3eWpoCFElqvgrP5Hhyo49zt+i/+xPCY79bpwWt4FsXPrOhlGGfr1L+pH+LUWO232VQg//T2Aqrg==",
                "sha1": "9e51fc924559f5226dfe5d635e60b9cdabada59b"
            },
            "filename": "bitcoinjs-wallet-5.4.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "4e048cf97aad3db8f2d784e6714eaa1cda1f9929a97d656c490d64f08f245fc1",
            "path": "postinstall.js",
            "tlsh": "88d1559362ea071d6856aaae4b8f00145671e2033c24faf43ecd47624f4e56c9eb57f8"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzgenesis00/bitcoinjs-wallet/MAL-2026-12119.json"