MAL-2026-13687

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tokocrytodev/MAL-2026-13687.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13687
Published
2026-08-10T11:50:11Z
Modified
2026-08-15T19:00:11Z
Summary
Malicious code in tokocrytodev (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6)

On module load, tokocrytodev instantiates a StealthC2 agent and starts a polling loop that fetches commands from https://badai.run.place/cekapppiapi.php?uid=, passes each response body to child_process.exec, and POSTs AES-256-ECB-encrypted stdout/stderr back to https://badai.run.place/fallback.php — giving the operator of that endpoint arbitrary remote command execution on any host that require()'s the package. In parallel, stealKeysAsync shells out find over /root/.ssh, /home/*/.ssh, /opt/wallet-keys, /etc/ssl/private, ~/.ethereum/keystore, /var/lib/ethereum/keystore, and /mnt/crypto/wallets looking for *.pem, .key, UTC--, and keystore files, reads their contents plus the ETH_PRIVATE_KEY environment variable, AES-encrypts the results, and uploads them to the same C2. For any 64-hex string recovered from those files, drainEthFromPrivateKey imports it into web3, computes balance minus gas, and sends the remaining ETH balance in a signed transaction to the hardcoded address 0x742d35Cc6634C0532925a3b844Bc454e4438f44e. Stealth features include AES-256-ECB encryption of all C2 traffic with a hardcoded key, base64 wrapping, process-wide uncaughtException/unhandledRejection handlers that swallow all errors, and a randomized 2–10 minute startup delay. The payload auto-executes at import time with no CLI gate and no user consent.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017206",
            "import_time": "2026-08-10T11:51:54.769328893Z",
            "modified_time": "2026-08-10T11:50:11Z",
            "sha256": "09fa98b6fd8313abbfeb250d10c12db28975f7bb12742f56dd5f1a3e1959d6d1",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-017974",
            "import_time": "2026-08-15T18:45:40.258381663Z",
            "modified_time": "2026-08-15T18:10:09Z",
            "sha256": "88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / tokocrytodev

Package

Name
tokocrytodev
View open source insights on deps.dev
Purl
pkg:npm/tokocrytodev

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "fd2296a3d972a05750609bbb1e0eb8c150e9edfd7819056b08b781cabb1f98f6",
            "tlsh": "aa0256551efb542006e3f4e9ab6b6006e137e10f7a45ddd87f4c57408f8a42846aebf8"
        }
    ],
    "package_integrity": [
        {
            "filename": "tokocrytodev-1.0.0.tgz",
            "hashes": {
                "sha1": "1b14f7fe21cda47171ce4ae39847db34787e9052",
                "sha512_sri": "sha512-OoWC9Dlj5bSfU/gGlk0h/hRZYpIpOyqMPV5DdjJuj2Dvz0StWt9id8EEzWo6ul/RWy0ZLUWO8/5BEXyQW2HIag=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tokocrytodev/MAL-2026-13687.json"