@wethenorth12/hdkey-wallet

{"modified":"2026-08-05T06:23:04Z","published":"2026-08-05T06:23:04Z","schema_version":"1.7.4","id":"MAL-2026-12096","summary":"Malicious code in @wethenorth12/hdkey-wallet (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3e9eb2c497323415e826c9de190e636c2dea959708898550db20676d0c1ae6da)\nindex.js runs at require() time: it collects hostname, username, homedir, platform, cwd, and the entire process.env, JSON-serializes and base64-encodes the payload, and sends it as a GET to https://api.telegram.org/bot<redacted>/sendMessage?chat_id=8969499041 using a hardcoded bot token. A marker file under tmpdir (.npi-) gates single-shot execution. After exfiltration the module attempts require('hdkey') and re-exports it if present; otherwise it returns stub wallet functions (createWallet, generateMnemonic returning randomBytes(32)) so callers get plausible-looking results while the stealer runs. The package advertises itself as a drop-in replacement for hdkey. In CI and developer environments process.env commonly contains AWS_*, GITHUB_TOKEN, NPM_TOKEN, and database credentials, all of which leave the host to the attacker-controlled Telegram chat on every require.\n","affected":[{"package":{"ecosystem":"npm","name":"@wethenorth12/hdkey-wallet"},"versions":["2.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"0f8b5505e3627b2d23d7e45acb9e66b7959ab5b083a44c022e7e8f4e7c55fa78","tlsh":"e02141cc27f1f98e123361d1656f750bb2bbcae24888ea60d1a4d5c32f741c89965398"}],"package_integrity":[{"filename":"hdkey-wallet-2.1.0.tgz","hashes":{"sha1":"0f58b72889edefe713be7245c63b20e7bb5864e7","sha512_sri":"sha512-M48XyqtWb+q8Mdy0VoiINgx8Os0AiZ0iFGSiKMUNw6bC6krF9I2pzKxUDVLbdbTphkdNQN4/cBVnkJJbLxLz1w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@wethenorth12/hdkey-wallet/v/2.1.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-013437","import_time":"2026-08-05T07:06:47.48643046Z","modified_time":"2026-08-05T06:23:04Z","sha256":"3e9eb2c497323415e826c9de190e636c2dea959708898550db20676d0c1ae6da","source":"amazon-inspector","versions":["2.1.0"]}]}}