MAL-2026-12347

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ccxt-trading/MAL-2026-12347.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12347
Published
2026-08-05T12:24:48Z
Modified
2026-08-05T13:35:02.160428043Z
Summary
Malicious code in ccxt-trading (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b0442271e1969ce5899ac9176cf8dfed0dbf8edd46fecf99ee8e3cd4f21a92d8)

Package name resembles the popular ccxt library. The exported ProExchange constructor, invoked whenever a consumer instantiates any exchange through the package's exchange map, captures the caller-supplied apiKey, secret, and password, gathers host identifiers (hostname, username, homedir, timestamp), and reads a list of home-directory files including wallet.json,.env, config.json, keypair.json, id_rsa, and credentials.json. The collected data is POSTed via https.request to the hardcoded destination enjbyg3xk8l.x.pipedream.net. The destination is not configurable, not documented, and is unrelated to any exchange API.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "b0442271e1969ce5899ac9176cf8dfed0dbf8edd46fecf99ee8e3cd4f21a92d8",
            "id": "IN-MAL-2026-014645",
            "modified_time": "2026-08-05T12:24:48Z",
            "import_time": "2026-08-05T13:08:33.332542083Z",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / ccxt-trading

Package

Name
ccxt-trading
View open source insights on deps.dev
Purl
pkg:npm/ccxt-trading

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "ef0b17e4703c83cb3d0ae017296c9fa15bd4aa106f1f800447078a8fe865fc88",
            "path": "index.js",
            "tlsh": "f85163d212d7a23249d2b593e37760419039da83fd19c885bbcc06f48f56058e8f6df8"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-PxEollu6cZcfghRnL8f7FOidd7ZrZRdc0ZoYsJcjfy429ESUYoJI6HGf1SaakUWd64LhKT2NvJ15o0rVnAAVLQ==",
                "sha1": "c298ccc47d982040a003759addbfd770cf6b6c20"
            },
            "filename": "ccxt-trading-1.0.0.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ccxt-trading/MAL-2026-12347.json"