MAL-2026-13213

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzcrypto/playwrite/MAL-2026-13213.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13213
Published
2026-08-05T15:32:21Z
Modified
2026-08-05T16:50:18.156300559Z
Summary
Malicious code in @zzzcrypto/playwrite (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c297b354235cda442a2ca4057884b85f1e29a920c6dcae318ab8149770ad80d0)

On require() of @zzzcrypto/playwrite, index.js harvests the installer's full process.env plus hostname, username, homedir, platform, cwd, and package identity, base64-encodes the payload, and issues an HTTPS GET to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot<redacted>/sendMessage?chat_id=8969499041) with the encoded data in the text query parameter. A tmpdir flag file guards against repeat sends. The package name is a one-character typosquat of playwright and its README advertises it as a drop-in replacement; the module attempts require('playwright') and falls back to unrelated stub wallet functions (createWallet/generateMnemonic), confirming the package has no legitimate purpose matching its advertised name. Full process.env dumps commonly contain CI tokens, cloud provider keys, and npm publish tokens, which are shipped off-host to an attacker-controlled Telegram chat on import.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015737",
            "import_time": "2026-08-05T16:13:38.306878342Z",
            "sha256": "c297b354235cda442a2ca4057884b85f1e29a920c6dcae318ab8149770ad80d0",
            "modified_time": "2026-08-05T15:32:21Z",
            "versions": [
                "1.48.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / @zzzcrypto/playwrite

Package

Name
@zzzcrypto/playwrite
View open source insights on deps.dev
Purl
pkg:npm/%40zzzcrypto/playwrite

Affected ranges

Affected versions

1.*
1.48.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-jja0E3pBz+IonH4jNIsOgQ/D9PvZcu72o1Am0UdICZsqohe4vA/yWqLUNVGhppAZqfF21Y/bzIoTtfO3xVKOww==",
                "sha1": "a84bbd1e1a4cadc1e6ff6fbeed496ca5eebf4cc4"
            },
            "filename": "playwrite-1.48.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "11e720930e3fbc3057455466abdee00c3b0e3875b00fa1032a18edacdd335b7f",
            "tlsh": "8b2133cc37f1f48e2273e192aa6f650bb6bbc9e10488e710e5a4d1c32fb41cc9955798"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zzzcrypto/playwrite/MAL-2026-13213.json"