gmgn-trading-kit

{"modified":"2026-09-09T18:24:40Z","published":"2026-09-09T17:46:07Z","schema_version":"1.7.4","id":"MAL-2026-16094","summary":"Malicious code in gmgn-trading-kit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9fd3a47d22b8a9b20523cc6fa00f3b8a73e51e057dbfc4fe0034a785219563c3)\npostinstall.cjs runs automatically on npm install and walks the filesystem harvesting installer secrets: SSH private keys under ~/.ssh, ~/.netrc, ~/.git-credentials, Solana keypairs, wallet.json/key.* files under ~/.config, and ~/.blockrun wallet files. It also walks upward from the install directory to filesystem root reading every.env it finds, filtering for KEY/SECRET/PRIVATE/TOKEN substrings. Each file's full contents is POSTed via https.request to a hardcoded webhook.site collector at https://webhook.site/d7ab73fe-7cbc-4ed3-bf8e-7207eb06875b. The harvester source self-labels as 'Master Harvester — injectable into any npm package via postinstall'.\n","affected":[{"package":{"ecosystem":"npm","name":"gmgn-trading-kit"},"versions":["1.7.0","1.7.1","1.7.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.cjs","sha256":"7029e56dd71155904b2019bed2a9a4cc8fcef704e9d795879e479ff65ee6d69d","tlsh":"39f08be116d27330aae18ac8e6977916d697d151b026d8c8b99c40b26f8f0a885a1df8"}],"package_integrity":[{"filename":"gmgn-trading-kit-1.7.0.tgz","hashes":{"sha1":"c48b12699b51929a08ecc7b9a2413f8b0ddf9213","sha512_sri":"sha512-NMpJnQeyhP0mSqCdzA1p7TsEr6PykAI/7zSoxj4tqyDv6EXUk82x7o3YhVsUqgtoDcqc+AN5QSbC5G1v1znPwA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/gmgn-trading-kit/v/1.7.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/gmgn-trading-kit/v/1.7.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/gmgn-trading-kit/v/1.7.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-019866","import_time":"2026-09-09T18:22:53.25416991Z","modified_time":"2026-09-09T17:46:14Z","sha256":"479f70b49153bb650f06d2417b76c83fc816449baf39b285f36aa034bfb8e8e7","source":"amazon-inspector","versions":["1.7.0"]},{"id":"IN-MAL-2026-019867","import_time":"2026-09-09T18:22:53.372524265Z","modified_time":"2026-09-09T17:46:21Z","sha256":"637c682c706a2efea958317394f04cf5f4cc44ee0f62a3c0c6b37c150f772bfa","source":"amazon-inspector","versions":["1.7.1"]},{"id":"IN-MAL-2026-019865","import_time":"2026-09-09T18:22:53.158505209Z","modified_time":"2026-09-09T17:46:07Z","sha256":"9fd3a47d22b8a9b20523cc6fa00f3b8a73e51e057dbfc4fe0034a785219563c3","source":"amazon-inspector","versions":["1.7.2"]}]}}