MAL-2026-13393

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/wallet-monitor-snap/MAL-2026-13393.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13393
Published
2026-08-06T12:14:59Z
Modified
2026-08-06T12:34:41.056773536Z
Summary
Malicious code in wallet-monitor-snap (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5c50a0acdc6be5b64538f83b0c14c3808ea3a57b963233ba32a2d80c3e4cc2c3)

wallet-monitor-snap is a MetaMask Snap whose onRpcRequest handler implements a 'showSecurityAlert' method that opens a snap_dialog inside MetaMask's trusted UI, tells the user their account has 'unusual activity', and prompts them to enter their Secret Recovery Phrase. The typed BIP-39 mnemonic is returned to the invoking dapp as { captured: result }. The snap declares endowment:rpc with dapps: true, so any web origin that can reach the snap can invoke this method and receive the seed phrase. In-source comments explicitly frame the package's advertised 'ping' and 'estimateGas' RPC methods as a cover story: 'Benign ping method so the snap appears legitimate during store review' and 'Gas estimation facade (the "legitimate" cover feature)'. Any HD wallet account derived from the phrase becomes fully controllable by the caller.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "5c50a0acdc6be5b64538f83b0c14c3808ea3a57b963233ba32a2d80c3e4cc2c3",
            "source": "amazon-inspector",
            "import_time": "2026-08-06T12:16:03.109507887Z",
            "modified_time": "2026-08-06T12:15:19Z",
            "versions": [
                "1.0.2"
            ],
            "id": "IN-MAL-2026-015993"
        },
        {
            "sha256": "8d0ebf8c78988557de084376ed4793bc8ca67d468d1c350ee8242ee2bc7e054c",
            "source": "amazon-inspector",
            "import_time": "2026-08-06T12:16:03.014188354Z",
            "modified_time": "2026-08-06T12:14:59Z",
            "versions": [
                "1.0.4"
            ],
            "id": "IN-MAL-2026-015992"
        }
    ]
}
References
Credits

Affected packages

npm / wallet-monitor-snap

Package

Name
wallet-monitor-snap
View open source insights on deps.dev
Purl
pkg:npm/wallet-monitor-snap

Affected ranges

Affected versions

1.*
1.0.2
1.0.4

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "e2da42db86e2bcc94ac2d3d4294c9eebdaaa09a6",
                "sha512_sri": "sha512-KtPxr27uF74AkIIhO6zzGbKuzNt2c21n2TqOGUs5Tg0pE5P9/Ber6mBGDtcfagsO7ibQ+XAKlhuIB60k+cZPUA=="
            },
            "filename": "wallet-monitor-snap-1.0.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "src/index.js",
            "sha256": "e27d15a9f1165b52fed129239dd36c34260a2e16f1926118ec27bc815d9ab873",
            "tlsh": "a94174eb66ee613c5c07a2217b5fa185bb70e1035a194c743d9d4bbc9f4d42c8136be8"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/wallet-monitor-snap/MAL-2026-13393.json"