MAL-2026-13211

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzcrypto/bitcoin-lib/MAL-2026-13211.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13211
Published
2026-08-05T15:32:11Z
Modified
2026-08-05T16:50:16.332624209Z
Summary
Malicious code in @zzzcrypto/bitcoin-lib (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f9d633d3efb27db376be57d77ebbd808db458d088503adebe2f7ad7501281dd1)

On require(), index.js serializes process.env together with hostname, username, homedir, platform, cwd, and a timestamp, base64-encodes the JSON, and sends it via HTTPS GET to api.telegram.org using a hardcoded bot token and chat_id. A tmp flag file gates re-execution to reduce noise. The package name @zzzcrypto/bitcoin-lib and its README present it as a drop-in for bitcoinjs-lib, and the code attempts require('bitcoinjs-lib') to transparently proxy the real library's API when present so callers observe normal behavior; the internal identifier in the exfil payload is @wethenorth12/bitcoin-lib, and identifier names in the harvester are scrambled (kffr, xqyv, qzph, _h). Environment variables in developer and CI processes routinely contain credentials, API tokens, and cloud keys, so this constitutes credential and host-identity theft against any process that imports the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "f9d633d3efb27db376be57d77ebbd808db458d088503adebe2f7ad7501281dd1",
            "id": "IN-MAL-2026-015736",
            "modified_time": "2026-08-05T15:32:11Z",
            "import_time": "2026-08-05T16:13:38.227552807Z",
            "source": "amazon-inspector",
            "versions": [
                "6.1.7"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @zzzcrypto/bitcoin-lib

Package

Name
@zzzcrypto/bitcoin-lib
View open source insights on deps.dev
Purl
pkg:npm/%40zzzcrypto/bitcoin-lib

Affected ranges

Affected versions

6.*
6.1.7

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "b1dd78dd96c7e7a5beef3e123cefa214464d4640ebe983055e47ea2bab8eea00",
            "path": "index.js",
            "tlsh": "4a2144c827b1f88e23726592643f610ab2abcae20848f751d5a9d1c72f741c889657cc"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-oDnNLw3grcwl6cjsJevIMsjU4uLyjdDfAXg/EyAOOZubbGnL3Zyc3/WK3/45hna+hPFhV4brD7BtV25KySB5og==",
                "sha1": "94b362e2da35fa0a9c64263ab145113a0e73b2c5"
            },
            "filename": "bitcoin-lib-6.1.7.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzcrypto/bitcoin-lib/MAL-2026-13211.json"