bitcoinjs-wallet

{"modified":"2026-08-05T15:40:48Z","published":"2026-08-05T15:40:48Z","schema_version":"1.7.4","id":"MAL-2026-13258","summary":"Malicious code in bitcoinjs-wallet (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8981a1bdc42ac6f595b3805c959060201fc4eb0c39b5bf50b25c5d3d7cc398b5)\nbitcoinjs-wallet@5.4.2 is a typosquat of bitcoinjs-lib that performs credential theft at module load. On require(), index.js collects hostname, username, homedir, platform, cwd and the entire process.env, JSON-stringifies and base64-encodes the payload, and transmits it via an HTTPS GET to the Telegram Bot API using a hardcoded bot token and chat_id 8969499041. A marker file in the OS tmpdir suppresses repeat sends. The bulk process.env dump captures any credentials the installer has in the environment (AWS_*, NPM_TOKEN, GITHUB_TOKEN, CI secrets, wallet-related variables). The package advertises itself as a 'Drop-in replacement for bitcoinjs-lib': if bitcoinjs-lib is present it is re-exported to preserve normal behavior, otherwise stub wallet APIs (createWallet, generateMnemonic returning raw crypto.randomBytes hex, signTransaction) are exposed as cover while the exfiltration has already fired.\n","affected":[{"package":{"ecosystem":"npm","name":"bitcoinjs-wallet"},"versions":["5.4.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"3d3afcdc0d19893d0b3b9448f5f98f669bb799388a036204fd12d688d871297c","tlsh":"182166dc27f1f94e22336142542f610ab2bbdae20488e661d5a4d0c76f741cc8d6578c"}],"package_integrity":[{"filename":"bitcoinjs-wallet-5.4.2.tgz","hashes":{"sha1":"a110b42bb07aaaa0fd6ee07e703995cceea4d590","sha512_sri":"sha512-7eb92FVkFdSgcmcKZgONSzPm7mcHbi9/2rGiJ3ykMLklfAbi/O7YuhNwBd0rPgNFOQ6BhZ4DetTvUzUMDYg17w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/bitcoinjs-wallet/v/5.4.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015791","import_time":"2026-08-05T16:13:45.566098877Z","modified_time":"2026-08-05T15:40:48Z","sha256":"8981a1bdc42ac6f595b3805c959060201fc4eb0c39b5bf50b25c5d3d7cc398b5","source":"amazon-inspector","versions":["5.4.2"]}]}}