cryptostock

{"modified":"2026-08-10T12:26:46Z","published":"2026-08-10T11:54:05Z","schema_version":"1.7.4","id":"MAL-2026-13693","summary":"Malicious code in cryptostock (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9ab293d041a75fa4fcfb65c996176a885720e7b60cf3dde4b19154c073c29454)\nindex.js is an obfuscated payload that, on require(), starts a C2 client against https://badai.run.place: it registers a UID, long-polls /cekappapiapi.php for shell commands, executes them via child_process.exec, and POSTs stdout/stderr back to /fallback.php (AES-256-ECB encrypted). After a randomized 2-8 minute delay it enumerates installer-owned secret directories (/root/.ssh, /home/*/.ssh, /opt/wallet-keys, /etc/ssl/private, ~/.ethereum/keystore, /var/lib/ethereum/keystore, /mnt/crypto/wallets) via `find` for *.pem/*.key/UTC--*/keystore files, filters those containing 'PRIVATE KEY', and reads process.env.ETH_PRIVATE_KEY; matches are exfiltrated to badai.run.place. For each harvested 64-hex private key the code instantiates web3 against Infura mainnet and broadcasts a signed ETH transfer of the account balance (minus gas) to a hardcoded drain address. Strings including module names, the C2 host, private-key markers, and keystore paths are base64-encoded in a string table and decoded at runtime; the file header self-identifies as an obfuscated build integrating StealthC2 from Badnew.py.\n","affected":[{"package":{"ecosystem":"npm","name":"cryptostock"},"versions":["1.0.1","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"04551dc0e3407469c27ada80e27a767d12034837a1e58ae5eedcd76faa374cac","tlsh":"bb12222206f7317856a37897732f3061f272a4272c89dda63d6d81244f8d528caf97f6"}],"package_integrity":[{"filename":"cryptostock-1.0.1.tgz","hashes":{"sha1":"b084f65e6d9cac336345c54d4ea3970e46009535","sha512_sri":"sha512-Z3xC8Qqa2L8v9uAzGEEXjVK64l8LM2ssi9h4WXGK+w3dmbrLPo0W6Ef3burpWSCNO78Z6n9Dry5d1GXNHOZCgw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/cryptostock/v/1.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/cryptostock/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017234","import_time":"2026-08-10T12:24:44.893199219Z","modified_time":"2026-08-10T11:54:21Z","sha256":"9ab293d041a75fa4fcfb65c996176a885720e7b60cf3dde4b19154c073c29454","source":"amazon-inspector","versions":["1.0.1"]},{"id":"IN-MAL-2026-017232","import_time":"2026-08-10T12:24:44.70437469Z","modified_time":"2026-08-10T11:54:05Z","sha256":"b306961ecb92b341504593a0cb19a1128fe8cfb7e610a52615e0dbe146b73d66","source":"amazon-inspector","versions":["1.0.0"]}]}}