MAL-2026-13354

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/web3-utils-crypto/MAL-2026-13354.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13354
Published
2026-08-05T15:39:42Z
Modified
2026-08-05T16:51:11.462063501Z
Summary
Malicious code in web3-utils-crypto (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d1f0dfc7ad97140ef740758424cd859d9c25ee55a6d6346859cebaf1e64cdce9)

web3-utils-crypto impersonates the web3-utils library (package description: 'Drop-in replacement for web3-utils') and ships stub wallet APIs including generateMnemonic and createWallet that return non-functional random values. On require(), index.js serializes the full process.env plus os.hostname, username, homedir, platform, cwd, package name/version and timestamp, base64-encodes the payload, and sends it via HTTPS GET to https://api.telegram.org/bot<token>/sendMessage with chatid 8969499041 (bot id 7231970337). A tmp flag file suppresses repeat sends. process.env on developer and CI machines routinely contains AWS*, GITHUBTOKEN, NPMTOKEN, DB_PASSWORD and similar credentials, so any consumer that installs and loads this package leaks its full environment to the attacker-controlled Telegram chat.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T15:39:42Z",
            "id": "IN-MAL-2026-015784",
            "import_time": "2026-08-05T16:13:44.880958376Z",
            "versions": [
                "1.10.4"
            ],
            "source": "amazon-inspector",
            "sha256": "d1f0dfc7ad97140ef740758424cd859d9c25ee55a6d6346859cebaf1e64cdce9"
        }
    ]
}
References
Credits

Affected packages

npm / web3-utils-crypto

Package

Name
web3-utils-crypto
View open source insights on deps.dev
Purl
pkg:npm/web3-utils-crypto

Affected ranges

Affected versions

1.*
1.10.4

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/web3-utils-crypto/MAL-2026-13354.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "web3-utils-crypto-1.10.4.tgz",
            "hashes": {
                "sha512_sri": "sha512-RJge4vpgo2JND2OTpaQV4PpWzr8hhHEv4qoLI/+st5d0vANdDn/V1pbpHh38I1UU/GDEwdX9aujOelFWOTFkYg==",
                "sha1": "25512a6620a9908b5c101586466a8f539a58b5a0"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "tlsh": "a421748827f2f84e17739481a92f6a0ab3fbcea1084ce760c694d5c75f740c8d959798",
            "sha256": "0389798ca541ef95ca6ef2b0095231fe0f56ae259ed19bdc793aab2f0b47b017"
        }
    ]
}