test__123q2

{"modified":"2026-08-31T18:02:43Z","published":"2026-08-31T18:02:43Z","schema_version":"1.7.4","id":"MAL-2026-15638","summary":"Malicious code in test__123q2 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1b08920ddaa70b578792ec7097f9d47047bdfe436a44475ed8274037ce6d6386)\nOn npm install, the package's postinstall script sweeps the installer's home directory for crypto wallet and credential material and uploads it to an attacker-controlled Telegram bot. Targets include browser wallet extension profiles for MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), Phantom, Trust, Coinbase, OKX, Rabby, Keplr, TronLink, Ronin, Solflare and Exodus; desktop wallets Exodus, Atomic, Electrum, Bitcoin Core (wallet.dat), Ledger Live, Trezor Suite, Wasabi, Sparrow, Guarda, Coinomi and Jaxx; and files under Desktop, Documents, Downloads and Projects matching mnemonic/seed/bip39/privatekey keywords plus.env,.npmrc,.netrc, id_rsa and ~/.aws material. Collected files are tarballed via the `tar` dependency and POSTed as a document to a hardcoded Telegram Bot API endpoint (https://api.telegram.org/bot<BOT_TOKEN>/sendDocument); the destination is not user-configurable. The package name and version carry no legitimate functionality that would justify this behavior.\n","affected":[{"package":{"ecosystem":"npm","name":"test__123q2"},"versions":["2.1.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/script.js","sha256":"66b57d10b71c33dcb1617216f316a97309d945f7b159818a75573f4d09378c4b","tlsh":"e513c66755ebe0180527f59aaf1f6006265c191b790cf94cbb9cca885fc93b891f23bc"}],"package_integrity":[{"filename":"test__123q2-2.1.1.tgz","hashes":{"sha1":"d78ee632879a0393e2aa6550dfb8469806d47282","sha512_sri":"sha512-uxciwcioRPPGbyz2d/aUpZF6qd2wMabqSsIZzwkBWO+ytrgVcP1QVl/XU2p4o3PEUPN5dZz8T2BiYNXsI6Gbng=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/test__123q2/v/2.1.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019306","import_time":"2026-08-31T18:22:29.575846961Z","modified_time":"2026-08-31T18:02:43Z","sha256":"1b08920ddaa70b578792ec7097f9d47047bdfe436a44475ed8274037ce6d6386","source":"amazon-inspector","versions":["2.1.1"]}]}}