tokocrytodev

{"schema_version":"1.7.4","id":"MAL-2026-13687","published":"2026-08-10T11:50:11Z","modified":"2026-08-15T18:47:27.437709768Z","summary":"Malicious code in tokocrytodev (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6)\nOn module load, tokocrytodev instantiates a StealthC2 agent and starts a polling loop that fetches commands from https://badai.run.place/cekapppiapi.php?uid=<host-id>, passes each response body to child_process.exec, and POSTs AES-256-ECB-encrypted stdout/stderr back to https://badai.run.place/fallback.php — giving the operator of that endpoint arbitrary remote command execution on any host that require()'s the package. In parallel, stealKeysAsync shells out `find` over /root/.ssh, /home/*/.ssh, /opt/wallet-keys, /etc/ssl/private, ~/.ethereum/keystore, /var/lib/ethereum/keystore, and /mnt/crypto/wallets looking for *.pem, *.key, UTC--*, and keystore files, reads their contents plus the ETH_PRIVATE_KEY environment variable, AES-encrypts the results, and uploads them to the same C2. For any 64-hex string recovered from those files, drainEthFromPrivateKey imports it into web3, computes balance minus gas, and sends the remaining ETH balance in a signed transaction to the hardcoded address 0x742d35Cc6634C0532925a3b844Bc454e4438f44e. Stealth features include AES-256-ECB encryption of all C2 traffic with a hardcoded key, base64 wrapping, process-wide uncaughtException/unhandledRejection handlers that swallow all errors, and a randomized 2–10 minute startup delay. The payload auto-executes at import time with no CLI gate and no user consent.\n","affected":[{"package":{"name":"tokocrytodev","ecosystem":"npm"},"versions":["1.0.0","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"fd2296a3d972a05750609bbb1e0eb8c150e9edfd7819056b08b781cabb1f98f6","tlsh":"aa0256551efb542006e3f4e9ab6b6006e137e10f7a45ddd87f4c57408f8a42846aebf8"}],"package_integrity":[{"filename":"tokocrytodev-1.0.0.tgz","hashes":{"sha1":"1b14f7fe21cda47171ce4ae39847db34787e9052","sha512_sri":"sha512-OoWC9Dlj5bSfU/gGlk0h/hRZYpIpOyqMPV5DdjJuj2Dvz0StWt9id8EEzWo6ul/RWy0ZLUWO8/5BEXyQW2HIag=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/tokocrytodev/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/tokocrytodev/v/1.0.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017206","import_time":"2026-08-10T11:51:54.769328893Z","modified_time":"2026-08-10T11:50:11Z","sha256":"09fa98b6fd8313abbfeb250d10c12db28975f7bb12742f56dd5f1a3e1959d6d1","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-017974","import_time":"2026-08-15T18:45:40.258381663Z","modified_time":"2026-08-15T18:10:09Z","sha256":"88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6","source":"amazon-inspector","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}