MAL-2026-13346

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hdkey-wallet/MAL-2026-13346.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13346
Published
2026-08-05T15:39:52Z
Modified
2026-08-05T16:51:04.369105919Z
Summary
Malicious code in hdkey-wallet (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4b36c64fed7b6d50787a971cc649c1f97605f6ea7027f388e9185ea85a580013)

On module load, index.js reads the complete process.env object along with hostname, username, home directory, platform, and current working directory, JSON-encodes and base64-wraps the payload, and transmits it via https.get to api.telegram.org's Bot API using a hardcoded bot token and chatid 8969499041. A tmpdir flag file guards against repeated exfiltration. The package name and README present it as a drop-in replacement for the legitimate hdkey library, and the module attempts to require('hdkey') and re-export it when present, using the real library as a functional cover for the credential theft that fires on require(). Environments commonly holding secrets such as AWS*, NPMTOKEN, and GITHUBTOKEN in process.env are directly exposed to the attacker-controlled Telegram bot.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:39:52Z",
            "id": "IN-MAL-2026-015785",
            "import_time": "2026-08-05T16:13:44.947783897Z",
            "versions": [
                "2.1.0"
            ],
            "source": "amazon-inspector",
            "sha256": "4b36c64fed7b6d50787a971cc649c1f97605f6ea7027f388e9185ea85a580013"
        }
    ]
}
References
Credits

Affected packages

npm / hdkey-wallet

Package

Name
hdkey-wallet
View open source insights on deps.dev
Purl
pkg:npm/hdkey-wallet

Affected ranges

Affected versions

2.*
2.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "hdkey-wallet-2.1.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-U//ZHzPrjKkQ/Fpa5bVYgDjBva3ZQR1xz4dg7ZLKacYjgWDyq0WsLTAZSS0szorYvC0RqPgJ/QhJA/Na6z96tA==",
                "sha1": "5baaa0f0825d784028dcc6e42997ea19b7fede4f"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "e02141cc27f1f98e123361d1656f750bb2bbcae24888ea60d1a4d5c32f741c89965398",
            "sha256": "0f8b5505e3627b2d23d7e45acb9e66b7959ab5b083a44c022e7e8f4e7c55fa78"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hdkey-wallet/MAL-2026-13346.json"