MAL-2026-6524

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ts-einkle/MAL-2026-6524.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6524
Aliases
  • GHSA-mjcv-m7fg-mg8j
Published
2026-06-26T14:16:24Z
Modified
2026-06-29T03:31:42.761038240Z
Summary
Malicious code in ts-einkle (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fa992a8f9afcf95d3c0e35b6abc290ff565b450663f6d43511467cd370eefce8)

ts-einkle@1.1.3 ships a comprehensive installer-side stealer in its main module peer-math.js. On require, syncSession() runs a chain (packProjectBundle, packWalletsAndCreds, packDeepScan) that: (1) reads classic credential paths including ~/.ssh, ~/.aws, ~/.gnupg, ~/.npmrc, ~/.pypirc, ~/.docker/config.json, ~/.git-credentials, and ~/.config/gh/hosts.yml; (2) on Windows invokes PowerShell ProtectedData::Unprotect (DPAPI) against Chromium Local State os_crypt.encrypted_key to derive the master key and decrypt the Login Data SQLite to plaintext passwords; (3) copies Firefox key4.db/logins.json, Bitwarden data.json, KeePass .kdbx, and 1Password SQLite vaults; (4) packs browser wallet extension stores for MetaMask, Phantom, Solflare, OKX, Coinbase, TrustWallet, Backpack, and TronLink; (5) packs Telegram Desktop tdata; (6) enumerates home and drives for wallet/seed/mnemonic/key keyword matches; (7) collects browser cookies, clipboard, shell history, and scrapes source trees. Captured data is POSTed to https://datasecure-service.vercel.app/api/v1 (overridable via PSM_API_URL). package.json declares "postinstall": "node test.js", so installation is intended to auto-trigger the chain. Cover-story labels (functions renamed from_str_1..17, sentinel files named data-backup-upload-*.sent) and a themed name with keywords polymarket, kelly, stake impersonate benign tooling; the README itself refers to the upload endpoint as a "C2 URL".

Source: ghsa-malware (6dc191a91bfcc0bd37051e540aa2ba32ffe82b577fba8a0e21a4e1d006a16cb6)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-26T14:59:21.344860649Z",
            "modified_time": "2026-06-26T14:16:24Z",
            "sha256": "25da283df3c201222ff1542da14b7fe428ab18aad7641d3521d2d4274d373e0b",
            "versions": [
                "1.0.9"
            ],
            "id": "IN-MAL-2026-007606",
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-06-27T15:57:48.922434147Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "source": "amazon-inspector",
            "sha256": "b011dddf3acc2a1269d8bb864414696c8d44fadb2593544e4d26cb2ce641cf01",
            "versions": [
                "1.1.2"
            ],
            "id": "IN-MAL-2026-007680",
            "modified_time": "2026-06-27T15:45:38Z"
        },
        {
            "import_time": "2026-06-27T15:57:48.966256979Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "source": "amazon-inspector",
            "sha256": "1ff02c0869d8d15a81a6172fd66e0f89de1502c21314fa81c6b7fbc7ecf559b4",
            "versions": [
                "1.1.0"
            ],
            "id": "IN-MAL-2026-007681",
            "modified_time": "2026-06-27T15:45:45Z"
        },
        {
            "import_time": "2026-06-27T19:35:55.782238203Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "source": "amazon-inspector",
            "sha256": "fa992a8f9afcf95d3c0e35b6abc290ff565b450663f6d43511467cd370eefce8",
            "versions": [
                "1.1.3"
            ],
            "id": "IN-MAL-2026-007685",
            "modified_time": "2026-06-27T19:12:43Z"
        },
        {
            "import_time": "2026-06-29T03:26:14.378440543Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "modified_time": "2026-06-29T03:18:54Z",
            "sha256": "6dc191a91bfcc0bd37051e540aa2ba32ffe82b577fba8a0e21a4e1d006a16cb6",
            "id": "GHSA-mjcv-m7fg-mg8j",
            "source": "ghsa-malware"
        }
    ]
}
References
Credits

Affected packages

npm / ts-einkle

Package

Name
ts-einkle
View open source insights on deps.dev
Purl
pkg:npm/ts-einkle

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.9
1.1.0
1.1.2
1.1.3

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "2842a7da10a77926c67127b8db074019ff67da6735224646f2fc42883f7212891e6fdc",
            "sha256": "1b94a9fcccb1a7188a3b83aea020bf890a66fb0a32d35456f03d8310e7b163b6",
            "path": "index.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "ts-einkle-1.0.9.tgz",
            "hashes": {
                "sha1": "07fc1e609cf4fa60151abcaa20e65a71aa7112c0",
                "sha512_sri": "sha512-Mvwq7v93WRwzkyAoiF96nAiwSdp1FzScwH65q+9jNrfobJ/0U7UWeE4LoFE5PapWtXHrePdDEPXQMXkWkVfVpw=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ts-einkle/MAL-2026-6524.json"