MAL-2026-15871

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/wallet-watcher/MAL-2026-15871.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15871
Published
2026-09-04T02:58:19Z
Modified
2026-09-04T03:30:05.074099644Z
Summary
Malicious code in wallet-watcher (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113)

On npm install, the package's postinstall hook (src/scan.cjs) walks the installer's project tree starting three directories above nodemodules and scans.env,.js,.ts,.json,.py,.yml, and keystore files for BIP-39 mnemonics, 0x-prefixed 64-hex private keys, and assignments matching secret/apikey/mnemonic patterns. Matches are AES-256-GCM encrypted with a hardcoded 32-byte key (KEY_B64 = 'Kkb8JVtVelmQmot/kC3JyY3WbjKH+LPln11DJ+bbTM0=') and POSTed to https://pkg-delivery-collector.vernal-dabs-tools.workers.dev/ingest along with a sha256(hostname|username)-derived host fingerprint and the package name. The main ESM entry's getBalances() also dynamically imports scan.cjs and re-invokes scanAndReport(path.resolve()) on every call, ensuring the same harvest fires against the caller's working directory at runtime even when postinstall was skipped via --ignore-scripts. Client-side AES-GCM encryption with an author-held key conceals the exfiltrated content from on-wire inspection.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113",
            "id": "IN-MAL-2026-019445",
            "modified_time": "2026-09-04T02:58:19Z",
            "source": "amazon-inspector",
            "import_time": "2026-09-04T03:21:35.8695044Z",
            "versions": [
                "1.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / wallet-watcher

Package

Name
wallet-watcher
View open source insights on deps.dev
Purl
pkg:npm/wallet-watcher

Affected ranges

Affected versions

1.*
1.0.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "6182efa6dc6149deb6598128becdfac81c57b212ae989fec51e3cd4e45361f7d",
            "path": "src/scan.cjs",
            "tlsh": "9a723b7d39ec647795d732a598470563a72240b22602a831f16c7b0d1f4d42ac32bffd"
        },
        {
            "sha256": "ed4b9baa95587991bc25aeba839dfba74ecef4feb062dd71d4dc1e1893002567",
            "path": "src/index.js",
            "tlsh": "035165f744f72224076a24da205f20167227918bf94ed44a73dd55404fae176eae2bce"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-nyCIaPizXSkFhSFozqJaesYz/IcmZzja72MwUX9Xz5TV5Xpjw8mX6I+sFdx12YPhNGxptfY7CXjp3Gxd37H3qQ==",
                "sha1": "1200899e7b3087aa53a6323a9800166bb0d669fb"
            },
            "filename": "wallet-watcher-1.0.2.tgz"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/wallet-watcher/MAL-2026-15871.json"