@js-lib-team/env-parser

{"modified":"2026-08-21T03:56:26Z","published":"2026-08-21T03:56:26Z","schema_version":"1.7.4","id":"MAL-2026-14344","summary":"Malicious code in @js-lib-team/env-parser (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ae761b7dd660e94dd99388dedf8c2227fa6a683e314468e7a482cd649c2e1a47)\nPackage @js-lib-team/env-parser is advertised as an environment-variable parser but on require/import executes a top-level IIFE in index.js that reads the installer's local.env file, extracts values matching PRIVATE_KEY / SECRET / MNEMONIC via a 64-hex regex, and uses those keys to construct ethers.Wallet instances that sign and broadcast transactions transferring native-token balances (ETH/BNB/Polygon/Avalanche and other supported chains) from the installer's wallets to five hardcoded attacker-controlled destination addresses, including 0x70951410C5E9E938D8715288A7229548287a1a62 and bc1q4h4a2sjf4k9quhx7xrajfgcsaz082cv5h3g8dt. The load-time routine also sets process.title to 'systemd: [logrotate]' to disguise the Node process in ps/top output and ships helper stubs labelled 'Process Hiding & Persistence' and 'Polymorphic & Encryption Layers'. The declared parser purpose is a cover story; the actual behavior on module load is theft of installer-owned wallet key material and direct movement of funds to attacker addresses.\n","affected":[{"package":{"ecosystem":"npm","name":"@js-lib-team/env-parser"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"2b0cfe32c8d09979a8bb48f5267c01c4e1d9e71bb54769d661dbc72977cf8826","tlsh":"db729473fa626c5398b653980a3b2695f504673fa298587f3a7cb24c5f33f24c580d98"}],"package_integrity":[{"filename":"env-parser-1.0.0.tgz","hashes":{"sha1":"1d6d6492155dfd2074b62d8620379426b602297d","sha512_sri":"sha512-IquQdR4Uz21+N9KNa2/AGXnm0aDa2YbEg57ElSxrGjeix5Q3MqXlNFw1xzToaQz5OjRZJ8PjRpzWRzyTJkSvpw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@js-lib-team/env-parser/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018493","import_time":"2026-08-21T04:19:06.103849217Z","modified_time":"2026-08-21T03:56:26Z","sha256":"ae761b7dd660e94dd99388dedf8c2227fa6a683e314468e7a482cd649c2e1a47","source":"amazon-inspector","versions":["1.0.0"]}]}}