MAL-2026-15638

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test__123q2/MAL-2026-15638.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15638
Published
2026-08-31T18:02:43Z
Modified
2026-08-31T18:31:27.397894275Z
Summary
Malicious code in test__123q2 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1b08920ddaa70b578792ec7097f9d47047bdfe436a44475ed8274037ce6d6386)

On npm install, the package's postinstall script sweeps the installer's home directory for crypto wallet and credential material and uploads it to an attacker-controlled Telegram bot. Targets include browser wallet extension profiles for MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), Phantom, Trust, Coinbase, OKX, Rabby, Keplr, TronLink, Ronin, Solflare and Exodus; desktop wallets Exodus, Atomic, Electrum, Bitcoin Core (wallet.dat), Ledger Live, Trezor Suite, Wasabi, Sparrow, Guarda, Coinomi and Jaxx; and files under Desktop, Documents, Downloads and Projects matching mnemonic/seed/bip39/privatekey keywords plus.env,.npmrc,.netrc, id_rsa and ~/.aws material. Collected files are tarballed via the tar dependency and POSTed as a document to a hardcoded Telegram Bot API endpoint (https://api.telegram.org/bot<BOT_TOKEN>/sendDocument); the destination is not user-configurable. The package name and version carry no legitimate functionality that would justify this behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-31T18:22:29.575846961Z",
            "source": "amazon-inspector",
            "versions": [
                "2.1.1"
            ],
            "id": "IN-MAL-2026-019306",
            "modified_time": "2026-08-31T18:02:43Z",
            "sha256": "1b08920ddaa70b578792ec7097f9d47047bdfe436a44475ed8274037ce6d6386"
        }
    ]
}
References
Credits

Affected packages

npm / test__123q2

Package

Name
test__123q2
View open source insights on deps.dev
Purl
pkg:npm/test__123q2

Affected ranges

Affected versions

2.*
2.1.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/test__123q2/MAL-2026-15638.json"
indicators 
{
    "evidence_files": [
        {
            "path": "dist/script.js",
            "tlsh": "e513c66755ebe0180527f59aaf1f6006265c191b790cf94cbb9cca885fc93b891f23bc",
            "sha256": "66b57d10b71c33dcb1617216f316a97309d945f7b159818a75573f4d09378c4b"
        }
    ],
    "package_integrity": [
        {
            "filename": "test__123q2-2.1.1.tgz",
            "hashes": {
                "sha1": "d78ee632879a0393e2aa6550dfb8469806d47282",
                "sha512_sri": "sha512-uxciwcioRPPGbyz2d/aUpZF6qd2wMabqSsIZzwkBWO+ytrgVcP1QVl/XU2p4o3PEUPN5dZz8T2BiYNXsI6Gbng=="
            }
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]