@zzzgenesis00/mnemonic-to-key

{"modified":"2026-08-05T02:52:23Z","published":"2026-08-05T02:52:23Z","schema_version":"1.7.4","id":"MAL-2026-12056","summary":"Malicious code in @zzzgenesis00/mnemonic-to-key (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c3af286f89deaee9dcce3d85f9bd53bc2b03e63dccf0073c74988b3f3a3763e8)\nOn npm install, postinstall.js executes and enumerates installer-side secrets: files under ~/.ssh (non-.pub private keys), ~/.npmrc, ~/.gitconfig, Chrome/Chromium/Firefox profile stores (Cookies, Login Data, key4.db), and cryptocurrency wallet directories (.bitcoin,.ethereum,.solana,.metamask,.exodus,.electrum, and similar). It also runs `npm whoami` and `git config user.email` and reads a list of credential-shaped environment variables including NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS keys, MNEMONIC, SEED_PHRASE, ETHEREUM_PRIVATE_KEY, and WALLET_PRIVATE_KEY. The collected data is sent via HTTPS GET to api.telegram.org using a hardcoded bot token and chat_id, with a backup POST to a hardcoded subdomain of serveousercontent.com at path /collect. The postinstall file is disguised with a `module.exports = require('./index.js')` passthrough and a header comment describing it as environment verification, and exfiltration is delayed with a randomized 1.5–3.5s timer to run after install output completes. Behavior is unrelated to the package's advertised mnemonic-to-key purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"@zzzgenesis00/mnemonic-to-key"},"versions":["1.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"2e46ba2d0c5f4518044dcf9e12a0f277efd12f3173956cf42184d082c3dc0a8c","tlsh":"bdd1539612f607195892e9ae8b8f00241636d5073c20faf87edc47b16f4f52c9af57b8"}],"package_integrity":[{"filename":"mnemonic-to-key-1.2.0.tgz","hashes":{"sha1":"1eeda8b9d6113d6c4c626f34c398e1dfc5330263","sha512_sri":"sha512-/NboJPx+Lwk6x0/VzaTjgo/eCTurRJbE4xB3dgRDpgk3mCINMomzH6jw6pjLvRDOFhFn35YxgA+g7uh6L/i7Lw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@zzzgenesis00/mnemonic-to-key/v/1.2.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011965","import_time":"2026-08-05T03:12:04.702482241Z","modified_time":"2026-08-05T02:52:23Z","sha256":"c3af286f89deaee9dcce3d85f9bd53bc2b03e63dccf0073c74988b3f3a3763e8","source":"amazon-inspector","versions":["1.2.0"]}]}}