@zzzgenesis00/crypto-config

{"modified":"2026-08-04T22:08:55Z","published":"2026-08-04T22:08:55Z","schema_version":"1.7.4","id":"MAL-2026-11529","summary":"Malicious code in @zzzgenesis00/crypto-config (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0059f996b08ee001bad27a2ec933573651b171f5b4fcde2b1e12b7a4388c7ca3)\npostinstall.js runs automatically on `npm install` and enumerates installer-owned secret material: SSH private keys under ~/.ssh, ~/.npmrc, ~/.gitconfig, Chrome/Firefox profile cookie/login/key databases, cryptocurrency wallet directories (metamask, exodus, electrum, etc.), and a curated list of sensitive environment variables including NPM_TOKEN, AWS keys, GitHub tokens, ETHEREUM_PRIVATE_KEY, and MNEMONIC. It also invokes `npm whoami` and `git config user.email` to bind the exfil to a specific identity. The collected profile is sent via HTTPS GET to api.telegram.org using a hardcoded bot token and chat_id, and via HTTPS POST to a hardcoded serveousercontent.com tunnel endpoint at /collect; neither destination is caller-configurable. Delivery is jittered via setTimeout(1500 + Math.random()*2000) and identifiers throughout the script are mangled (_vaa, _zmj, _rlb, _cp, _ht, _tk, _ch, _co, _ex). The package name, author field (`lorenwest`, the maintainer of the legitimate `config` package), and homepage impersonate a benign configuration library, and index.js transparently proxies to the real `config` package when present as a cover for the install-time payload.\n","affected":[{"package":{"ecosystem":"npm","name":"@zzzgenesis00/crypto-config"},"versions":["2.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"46461df621855061727a1d7b05bee479bcfa5160a14919b50f7f9b3a12b77633","tlsh":"26d1849752e603696896b9ae4b5f50241633e2033c20fbf57ece0b510f4e12c9af57a9"}],"package_integrity":[{"filename":"crypto-config-2.0.1.tgz","hashes":{"sha1":"94ce11b3b5976ad317707b2a3726c788b468e869","sha512_sri":"sha512-M0as15cjWVnw34zhS/3jRoQsQsMXo74w4yYzhxdkVAM8mBo6puxl0rikd2b9ybHHXDdE5aBGtt4E5Id9jcxZhw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@zzzgenesis00/crypto-config/v/2.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011351","import_time":"2026-08-04T22:30:12.15145706Z","modified_time":"2026-08-04T22:08:55Z","sha256":"0059f996b08ee001bad27a2ec933573651b171f5b4fcde2b1e12b7a4388c7ca3","source":"amazon-inspector","versions":["2.0.1"]}]}}