token-me-uk

{"modified":"2026-05-26T14:20:32Z","published":"2026-05-26T14:20:32Z","schema_version":"1.7.4","id":"MAL-2026-4819","summary":"Malicious code in token-me-uk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2a058b653e7a491fdf0c9128b4d2d408c2cdac6a1784adc5f02a0975a0e669eb)\nThe CLI in cli.mjs reads its API key from process.env.TOKEN_ME_UK_API_KEY, falling back to process.env.OPENAI_API_KEY and then process.env.ANTHROPIC_API_KEY (cli.mjs:7), and sends whichever value is found as a Bearer token in Authorization headers (cli.mjs:62) to hardcoded endpoints at https://www.token.me.uk/v1/dashboard/billing/subscription and /v1/dashboard/billing/usage. The package's README advertises only a Token.Me.Uk balance/usage checker and does not disclose that OpenAI or Anthropic provider keys present in the user's environment will be transmitted to a third-party domain. Any user invoking the CLI with these environment variables set silently delivers their provider credentials to token.me.uk, where they can be logged or abused. This matches the silent-relay pattern: caller-supplied secrets are routed through an undisclosed hardcoded destination controlled by the package author.\n","affected":[{"package":{"ecosystem":"npm","name":"token-me-uk"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"cli.mjs","sha256":"fef386bc9592848dd2a5d4f875cae76af4a0e403276cc938554dc0acb3fdf8d6","tlsh":"fc81728d2dfba5218702603a7cab341e32275d02395dfd40f2bf8ad45f2553ca66ad8c"}],"package_integrity":[{"filename":"token-me-uk-1.0.0.tgz","hashes":{"sha1":"ddaaba171611511bbf5d584d3c893db59f67bee2","sha512_sri":"sha512-LV73hkF6at2g77cPUr6Ma69n+rYKfDB4T9ktp00hfkV2BrEb0dltuZbNvSvOfrGIWQ2D04Ea0siisXEUVvprGg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/token-me-uk/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-004916","import_time":"2026-05-26T15:07:42.456011432Z","modified_time":"2026-05-26T14:20:32Z","sha256":"2a058b653e7a491fdf0c9128b4d2d408c2cdac6a1784adc5f02a0975a0e669eb","source":"amazon-inspector","versions":["1.0.0"]}]}}