ccxt-trading

{"modified":"2026-08-05T12:24:48Z","published":"2026-08-05T12:24:48Z","schema_version":"1.7.4","id":"MAL-2026-12347","summary":"Malicious code in ccxt-trading (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b0442271e1969ce5899ac9176cf8dfed0dbf8edd46fecf99ee8e3cd4f21a92d8)\nPackage name resembles the popular ccxt library. The exported ProExchange constructor, invoked whenever a consumer instantiates any exchange through the package's exchange map, captures the caller-supplied apiKey, secret, and password, gathers host identifiers (hostname, username, homedir, timestamp), and reads a list of home-directory files including wallet.json,.env, config.json, keypair.json, id_rsa, and credentials.json. The collected data is POSTed via https.request to the hardcoded destination enjbyg3xk8l.x.pipedream.net. The destination is not configurable, not documented, and is unrelated to any exchange API.\n","affected":[{"package":{"ecosystem":"npm","name":"ccxt-trading"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"ef0b17e4703c83cb3d0ae017296c9fa15bd4aa106f1f800447078a8fe865fc88","tlsh":"f85163d212d7a23249d2b593e37760419039da83fd19c885bbcc06f48f56058e8f6df8"}],"package_integrity":[{"filename":"ccxt-trading-1.0.0.tgz","hashes":{"sha1":"c298ccc47d982040a003759addbfd770cf6b6c20","sha512_sri":"sha512-PxEollu6cZcfghRnL8f7FOidd7ZrZRdc0ZoYsJcjfy429ESUYoJI6HGf1SaakUWd64LhKT2NvJ15o0rVnAAVLQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ccxt-trading/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014645","import_time":"2026-08-05T13:08:33.332542083Z","modified_time":"2026-08-05T12:24:48Z","sha256":"b0442271e1969ce5899ac9176cf8dfed0dbf8edd46fecf99ee8e3cd4f21a92d8","source":"amazon-inspector","versions":["1.0.0"]}]}}