MAL-2026-13693

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cryptostock/MAL-2026-13693.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13693
Published
2026-08-10T11:54:05Z
Modified
2026-08-10T12:50:26.519419442Z
Summary
Malicious code in cryptostock (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (9ab293d041a75fa4fcfb65c996176a885720e7b60cf3dde4b19154c073c29454)

index.js is an obfuscated payload that, on require(), starts a C2 client against https://badai.run.place: it registers a UID, long-polls /cekappapiapi.php for shell commands, executes them via childprocess.exec, and POSTs stdout/stderr back to /fallback.php (AES-256-ECB encrypted). After a randomized 2-8 minute delay it enumerates installer-owned secret directories (/root/.ssh, /home//.ssh, /opt/wallet-keys, /etc/ssl/private, ~/.ethereum/keystore, /var/lib/ethereum/keystore, /mnt/crypto/wallets) via find for .pem/.key/UTC--/keystore files, filters those containing 'PRIVATE KEY', and reads process.env.ETHPRIVATE_KEY; matches are exfiltrated to badai.run.place. For each harvested 64-hex private key the code instantiates web3 against Infura mainnet and broadcasts a signed ETH transfer of the account balance (minus gas) to a hardcoded drain address. Strings including module names, the C2 host, private-key markers, and keystore paths are base64-encoded in a string table and decoded at runtime; the file header self-identifies as an obfuscated build integrating StealthC2 from Badnew.py.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-10T12:24:44.893199219Z",
            "sha256": "9ab293d041a75fa4fcfb65c996176a885720e7b60cf3dde4b19154c073c29454",
            "modified_time": "2026-08-10T11:54:21Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-017234",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "import_time": "2026-08-10T12:24:44.70437469Z",
            "sha256": "b306961ecb92b341504593a0cb19a1128fe8cfb7e610a52615e0dbe146b73d66",
            "modified_time": "2026-08-10T11:54:05Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-017232",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / cryptostock

Package

Name
cryptostock
View open source insights on deps.dev
Purl
pkg:npm/cryptostock

Affected ranges

Affected versions

1.*
1.0.0
1.0.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/cryptostock/MAL-2026-13693.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "04551dc0e3407469c27ada80e27a767d12034837a1e58ae5eedcd76faa374cac",
            "tlsh": "bb12222206f7317856a37897732f3061f272a4272c89dda63d6d81244f8d528caf97f6",
            "path": "index.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "cryptostock-1.0.1.tgz",
            "hashes": {
                "sha1": "b084f65e6d9cac336345c54d4ea3970e46009535",
                "sha512_sri": "sha512-Z3xC8Qqa2L8v9uAzGEEXjVK64l8LM2ssi9h4WXGK+w3dmbrLPo0W6Ef3burpWSCNO78Z6n9Dry5d1GXNHOZCgw=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]