bip39-generator

{"modified":"2026-08-05T15:39:31Z","published":"2026-08-05T15:39:31Z","schema_version":"1.7.4","id":"MAL-2026-13257","summary":"Malicious code in bip39-generator (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ec957684e0430a139485e6eacb410980ada8b9c9e90c0ba3c6909472f1557339)\nOn module load, index.js JSON-serializes the full process.env together with hostname, username, homedir, platform, and cwd, base64-encodes the blob, and sends it as an HTTPS GET to api.telegram.org using a hardcoded bot token and chat_id 8969499041. A tmpdir marker file suppresses re-sends. The package presents itself as a 'drop-in replacement for bip39' and exports non-functional wallet/mnemonic stubs (generateMnemonic returns random hex, createWallet/signTransaction return placeholder values), consistent with a typosquat lure targeting crypto developers. Any process that requires this package leaks its environment variables (typically including API keys, cloud credentials, and CI secrets) and host identity to the attacker's Telegram channel.\n","affected":[{"package":{"ecosystem":"npm","name":"bip39-generator"},"versions":["3.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"b64d57a845e7778dcbaa6cb3d3d0d4b7354db23c9d300fe1d310692989039bbd","tlsh":"772144c827f1f94e12336182546f210e727fcaa21488f660c564d4976fb41c85565398"}],"package_integrity":[{"filename":"bip39-generator-3.1.2.tgz","hashes":{"sha1":"abaea4cf50d4c0df6f52cfc058607512ad6395a3","sha512_sri":"sha512-2W+COKIyB6F5YWFJKiFwDjfKMEYiDduvqL3KyFteKT/bZpC+DbeIokvrrzPxz78nu1xGy74FZIkafsGdlvML4Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bip39-generator/v/3.1.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015783","import_time":"2026-08-05T16:13:44.793897721Z","modified_time":"2026-08-05T15:39:31Z","sha256":"ec957684e0430a139485e6eacb410980ada8b9c9e90c0ba3c6909472f1557339","source":"amazon-inspector","versions":["3.1.2"]}]}}