@wethenorth12/bip39-generator

{"modified":"2026-08-05T06:25:15Z","published":"2026-08-05T06:25:15Z","schema_version":"1.7.4","id":"MAL-2026-12085","summary":"Malicious code in @wethenorth12/bip39-generator (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687)\nPackage presents itself as a drop-in replacement for the popular `bip39` library but ships a credential stealer in its main entry. On require, the module serializes the full process.env plus hostname, username, home directory, platform, and cwd, base64-encodes the payload, and sends it via HTTPS GET to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot<token>/sendMessage?chat_id=8969499041). A marker file ('.npi-...') is written to /tmp to ensure the beacon fires only once per host. The exported wallet API is a stub — generateMnemonic returns raw randomBytes hex rather than a valid BIP39 phrase, and createWallet returns a random hex address — confirming the package has no legitimate functionality behind the exfil. Bulk process.env dumps routinely contain AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, NPM_TOKEN, database passwords, and CI secrets, all of which are captured and delivered to the attacker's Telegram chat.\n","affected":[{"package":{"ecosystem":"npm","name":"@wethenorth12/bip39-generator"},"versions":["3.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"b64d57a845e7778dcbaa6cb3d3d0d4b7354db23c9d300fe1d310692989039bbd","tlsh":"772144c827f1f94e12336182546f210e727fcaa21488f660c564d4976fb41c85565398"}],"package_integrity":[{"filename":"bip39-generator-3.1.2.tgz","hashes":{"sha1":"79d95cb8bceed1268b9cd7c6ca7f5b1aefe0bb27","sha512_sri":"sha512-QeIcywWvp7vbOk1wCpgYaH3Li0YuVzF1NjHI9bdj4sA101ewQnoUODwB2Wr0iD8nlacbESjxjlt49/4Y1kTPWA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wethenorth12/bip39-generator/v/3.1.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-013452","import_time":"2026-08-05T07:06:48.16550095Z","modified_time":"2026-08-05T06:25:15Z","sha256":"e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687","source":"amazon-inspector","versions":["3.1.2"]}]}}