MAL-2026-13367

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/clawtrl-wallet/MAL-2026-13367.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13367
Published
2026-08-05T18:12:01Z
Modified
2026-08-05T19:19:47.016062921Z
Summary
Malicious code in clawtrl-wallet (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d56c06b4b1f063e6827dc0d8e9a6e3d1b7395182c12188b4dc110b771c23386c)

The package's cli.js imports child_process, https, and os, reads process.env and system information (via os.tmpdir and related os APIs), spawns a bash subprocess, and issues outbound https.get requests. The composition — environment/system-data read paired with a bash spawn and outbound HTTPS from a wallet-branded npm package — matches the credential/wallet-stealer shape rather than any legitimate wallet library behavior. Wallet packages have no need to shell out to bash or transmit environment contents off-host, and the package name suggests impersonation of a wallet utility to lure installers.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T19:04:54.08948802Z",
            "sha256": "d56c06b4b1f063e6827dc0d8e9a6e3d1b7395182c12188b4dc110b771c23386c",
            "id": "IN-MAL-2026-015845",
            "modified_time": "2026-08-05T18:12:01Z",
            "versions": [
                "1.5.1"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / clawtrl-wallet

Package

Name
clawtrl-wallet
View open source insights on deps.dev
Purl
pkg:npm/clawtrl-wallet

Affected ranges

Affected versions

1.*
1.5.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/clawtrl-wallet/MAL-2026-13367.json"
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-wj8R5SmFHH3l/7anYyFAsuEJLD7E4JYo8K4HUyqIq4cNJ4SUR7ygtYVMzX76/F+Hn7QLDSgqyW8ASkU+2GcbRg==",
                "sha1": "ac228f81d3f3389147fe4395a3b7c8be1c6a3e06"
            },
            "filename": "clawtrl-wallet-1.5.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "tlsh": "0941815f46f2013166b3918d46179c26b483c4236210ea90bbed0115afc2975c1a77ff",
            "path": "cli.js",
            "sha256": "78c38d617be45b5432c700c565e414e35779b744e9b8338e2487259b4f8b83b7"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]