MAL-2026-13257

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bip39-generator/MAL-2026-13257.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13257
Published
2026-08-05T15:39:31Z
Modified
2026-08-05T16:49:56.374516009Z
Summary
Malicious code in bip39-generator (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ec957684e0430a139485e6eacb410980ada8b9c9e90c0ba3c6909472f1557339)

On module load, index.js JSON-serializes the full process.env together with hostname, username, homedir, platform, and cwd, base64-encodes the blob, and sends it as an HTTPS GET to api.telegram.org using a hardcoded bot token and chat_id 8969499041. A tmpdir marker file suppresses re-sends. The package presents itself as a 'drop-in replacement for bip39' and exports non-functional wallet/mnemonic stubs (generateMnemonic returns random hex, createWallet/signTransaction return placeholder values), consistent with a typosquat lure targeting crypto developers. Any process that requires this package leaks its environment variables (typically including API keys, cloud credentials, and CI secrets) and host identity to the attacker's Telegram channel.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:39:31Z",
            "source": "amazon-inspector",
            "sha256": "ec957684e0430a139485e6eacb410980ada8b9c9e90c0ba3c6909472f1557339",
            "import_time": "2026-08-05T16:13:44.793897721Z",
            "id": "IN-MAL-2026-015783",
            "versions": [
                "3.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / bip39-generator

Package

Name
bip39-generator
View open source insights on deps.dev
Purl
pkg:npm/bip39-generator

Affected ranges

Affected versions

3.*
3.1.2

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "bip39-generator-3.1.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-2W+COKIyB6F5YWFJKiFwDjfKMEYiDduvqL3KyFteKT/bZpC+DbeIokvrrzPxz78nu1xGy74FZIkafsGdlvML4Q==",
                "sha1": "abaea4cf50d4c0df6f52cfc058607512ad6395a3"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "772144c827f1f94e12336182546f210e727fcaa21488f660c564d4976fb41c85565398",
            "sha256": "b64d57a845e7778dcbaa6cb3d3d0d4b7354db23c9d300fe1d310692989039bbd",
            "path": "index.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/bip39-generator/MAL-2026-13257.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]