@zzzcrypto/playwrite

{"modified":"2026-08-05T15:32:21Z","published":"2026-08-05T15:32:21Z","schema_version":"1.7.4","id":"MAL-2026-13213","summary":"Malicious code in @zzzcrypto/playwrite (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c297b354235cda442a2ca4057884b85f1e29a920c6dcae318ab8149770ad80d0)\nOn require() of @zzzcrypto/playwrite, index.js harvests the installer's full process.env plus hostname, username, homedir, platform, cwd, and package identity, base64-encodes the payload, and issues an HTTPS GET to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot<redacted>/sendMessage?chat_id=8969499041) with the encoded data in the `text` query parameter. A tmpdir flag file guards against repeat sends. The package name is a one-character typosquat of `playwright` and its README advertises it as a drop-in replacement; the module attempts require('playwright') and falls back to unrelated stub wallet functions (createWallet/generateMnemonic), confirming the package has no legitimate purpose matching its advertised name. Full process.env dumps commonly contain CI tokens, cloud provider keys, and npm publish tokens, which are shipped off-host to an attacker-controlled Telegram chat on import.\n","affected":[{"package":{"ecosystem":"npm","name":"@zzzcrypto/playwrite"},"versions":["1.48.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"11e720930e3fbc3057455466abdee00c3b0e3875b00fa1032a18edacdd335b7f","tlsh":"8b2133cc37f1f48e2273e192aa6f650bb6bbc9e10488e710e5a4d1c32fb41cc9955798"}],"package_integrity":[{"filename":"playwrite-1.48.0.tgz","hashes":{"sha1":"a84bbd1e1a4cadc1e6ff6fbeed496ca5eebf4cc4","sha512_sri":"sha512-jja0E3pBz+IonH4jNIsOgQ/D9PvZcu72o1Am0UdICZsqohe4vA/yWqLUNVGhppAZqfF21Y/bzIoTtfO3xVKOww=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@zzzcrypto/playwrite/v/1.48.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015737","import_time":"2026-08-05T16:13:38.306878342Z","modified_time":"2026-08-05T15:32:21Z","sha256":"c297b354235cda442a2ca4057884b85f1e29a920c6dcae318ab8149770ad80d0","source":"amazon-inspector","versions":["1.48.0"]}]}}