MAL-2026-15637

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test__123q1/MAL-2026-15637.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15637
Published
2026-08-31T18:00:32Z
Modified
2026-08-31T18:31:27.261446793Z
Summary
Malicious code in test__123q1 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ac33922c804a14a307d55fb3dc80531482503bee2c96cc7fa4a487101c70e7d6)

The package declares a postinstall hook (node dist/script.js) while its declared main entry (dist/index.js) is an inert 105-byte stub, so the entire behavior fires at npm install time. The postinstall script walks the installer's home directory and common workspace folders (Desktop, Documents, Downloads, Projects, Backups) and (1) reads browser wallet extension profiles for MetaMask, Phantom, Trust, Coinbase, OKX, Rabby, Keplr, Solflare, TronLink, Ronin, and Exodus, along with desktop wallet stores for Exodus, Electrum, Bitcoin Core, Ledger Live, Trezor Suite, Wasabi, and Sparrow, plus any files matching seed/mnemonic/bip39/privatekey/keystore keywords; (2) enumerates a hardcoded list of sensitive files including .env*, .npmrc, .yarnrc, .pnpmrc, .netrc, .git-credentials, .gitconfig, id_rsa/id_ed25519/id_ecdsa, .pem/private.key, aws.json, gcloud.json, service-account.json, and firebase-adminsdk.json. Collected material is packaged with tar and uploaded to a hardcoded Telegram bot endpoint at https://api.telegram.org/bot<BOT_TOKEN>/sendDocument. The script additionally harvests the installer's npm auth token, writes //registry.npmjs.org/:_authToken=${token} into an .npmrc, queries registry.npmjs.org/-/whoami and registry.npmjs.org/-/v1/search to enumerate the victim maintainer's other packages, and copies its own dist payload into them via fs.cp('dist', pathToInject, { recursive: true }) to republish malicious versions under the victim's identity.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-31T18:22:28.866034458Z",
            "id": "IN-MAL-2026-019292",
            "versions": [
                "4.3.5"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-31T18:00:32Z",
            "sha256": "821d5a8f06ba3e50a1b5afe5d6d824cd3e48f67dd1ca573cdc273dbfecaacd47"
        },
        {
            "import_time": "2026-08-31T18:22:28.981519466Z",
            "id": "IN-MAL-2026-019293",
            "versions": [
                "3.2.4"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-31T18:00:39Z",
            "sha256": "ac33922c804a14a307d55fb3dc80531482503bee2c96cc7fa4a487101c70e7d6"
        }
    ]
}
References
Credits

Affected packages

npm / test__123q1

Package

Name
test__123q1
View open source insights on deps.dev
Purl
pkg:npm/test__123q1

Affected ranges

Affected versions

3.*
3.2.4
4.*
4.3.5

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test__123q1/MAL-2026-15637.json"
indicators 
{
    "evidence_files": [
        {
            "path": "dist/script.js",
            "tlsh": "4113c66755ebe0180527f59aaf1f6006265c191b790cf94cbb9cca885fc93b891f23bc",
            "sha256": "6e5dadc949ddb9c504d5fb602d09b55209473966f1b9537aa27758743ae40dc7"
        },
        {
            "path": "package.json",
            "tlsh": "c0e0df34cd749e7326dc22e98c7a6153a662099b0018fd1c72cb616c472d2f754be2ae",
            "sha256": "f78007c2cc483e06f9ae2af1e20403368e39ef2465ec7b1a00e154176c2f9c22"
        }
    ],
    "package_integrity": [
        {
            "filename": "test__123q1-4.3.5.tgz",
            "hashes": {
                "sha1": "25c421263dc348cf35d9738bf952780bc1a09593",
                "sha512_sri": "sha512-XtGYdk04VLRz0Dhfmt3KNvvKldBr2gm29NskFy6YP0xrBkulacS4/8e0QInqIJQzPsxxSs4HMTL+4GCmPxol1w=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]