MAL-2026-13280

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/docker-api-client/MAL-2026-13280.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13280
Published
2026-08-05T15:32:51Z
Modified
2026-08-05T16:50:31.384336482Z
Summary
Malicious code in docker-api-client (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f02e61d324161238593fb7e59dc907f183bf885a908354fed1eba0662906947b)

docker-api-client@2.0.2 is a typosquat of dockerode. On require(), index.js collects hostname, username, homedir, platform, cwd, and the entire process.env object, JSON-serializes and base64-encodes the payload, and sends it via HTTPS GET to api.telegram.org bot sendMessage with a hardcoded bot token and chatid; a tmp flag file marks first-run. The environment dump routinely contains CI/CD tokens, cloud credentials (AWS*, GITHUBTOKEN, NPMTOKEN), and database secrets, so any process that imports this package leaks its full credential-bearing environment to an attacker-controlled Telegram chat. The module's fallback exports expose wallet primitives (createWallet, signTransaction, generateMnemonic) that do not match the advertised Docker API purpose, confirming the package as a cover-story lure rather than a Docker client.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "f02e61d324161238593fb7e59dc907f183bf885a908354fed1eba0662906947b",
            "id": "IN-MAL-2026-015740",
            "modified_time": "2026-08-05T15:32:51Z",
            "source": "amazon-inspector",
            "import_time": "2026-08-05T16:13:38.850310471Z",
            "versions": [
                "2.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / docker-api-client

Package

Name
docker-api-client
View open source insights on deps.dev
Purl
pkg:npm/docker-api-client

Affected ranges

Affected versions

2.*
2.0.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "61b1bdbea5feaad1597373c965d6f79e991651cf98aa089a3245fc6de267fe7e",
            "path": "index.js",
            "tlsh": "272141cc67f1f59e22336592a42f610eb2bbcee25988fb10d198d4c76f741cc8959398"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-bpEIwExcq0JcNwF0Wru3EQggXJWDSjG7+zNNae/8JvLNQtoQqZUud8dBAgAujhUv5ZXNtM6AC/MJ8+Qi1oAv5A==",
                "sha1": "a8a916bf0e1a1a6d511c6f1ad8ff5d02606ee8d6"
            },
            "filename": "docker-api-client-2.0.2.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/docker-api-client/MAL-2026-13280.json"