Malicious code in @zzzgenesis00/etherjs (npm)

Source: amazon-inspector bc49c7ec56350694f458d9468efb51a30a9ac20ff490ac44b0cedd8bbbe004a5 The package is published as @zzzgenesis00/etherjs with author 'ricmoo' and a description mimicking the legitimate ethers.js library. On npm install, postinstall.js executes and enumerates installer-side...

Malicious code in @zzzgenesis00/solana-web3 (npm)

Source: amazon-inspector 433d4c4c3c8984e1fdd1a47623a9d5cf7c464ff9a64ce32846a76f10e3224dce This package impersonates Solana Labs author field 'solana-labs', repository pointing at github.com/solana-labs/solana-web3 under an unrelated scope. Its postinstall.js runs automatically on npm install and,...

Malicious code in @zzzgenesis00/env-loader (npm)

Source: amazon-inspector cfbfc9bcbea1e1b9d6c52e2585bf5b28064fe8e38fe53304450fe1fd19340f3b On npm install, postinstall.js reads installer-owned secret material — /.ssh entries, /.npmrc, /.gitconfig — and iterates a curated list of credential and wallet environment variables NPMTOKEN, GITHUBTOKEN,...

Malicious code in @aster110/cc2wechat (npm)

Source: amazon-inspector a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac The package runs a daemon that long-polls Tencent's iLink Bot API ilinkai.weixin.qq.com for incoming WeChat messages and forwards each message body into a locally hosted AI agent that is spawned with all...

Malicious code in hdkey-wallet (npm)

Source: amazon-inspector 4b36c64fed7b6d50787a971cc649c1f97605f6ea7027f388e9185ea85a580013 On module load, index.js reads the complete process.env object along with hostname, username, home directory, platform, and current working directory, JSON-encodes and base64-wraps the payload, and transmits...

Malicious code in hd-key-generator (npm)

Source: amazon-inspector 3a102f1d05a0bd89af765e457c2b5d6121ec831d33549d0cbf9795d58b0d3ee6 hd-key-generator is a typosquat of the hdkey package. On require, index.js reads process.env, os.hostname, os.userInfo.username, the user's home directory, platform, cwd, and package metadata, JSON-serialize...

Malicious code in bitcoinjs-wallet (npm)

Source: amazon-inspector 8981a1bdc42ac6f595b3805c959060201fc4eb0c39b5bf50b25c5d3d7cc398b5 [email protected] is a typosquat of bitcoinjs-lib that performs credential theft at module load. On require, index.js collects hostname, username, homedir, platform, cwd and the entire process.env,...

Malicious code in @zzzcrypto/playwrite (npm)

Source: amazon-inspector c297b354235cda442a2ca4057884b85f1e29a920c6dcae318ab8149770ad80d0 On require of @zzzcrypto/playwrite, index.js harvests the installer's full process.env plus hostname, username, homedir, platform, cwd, and package identity, base64-encodes the payload, and issues an HTTPS G...

Malicious code in aws-sdk-v4 (npm)

Source: amazon-inspector 3753967ef5752d68dd0880c092d77ab42bb18fe5e081c258961572581cb81aa7 Package aws-sdk-v4 impersonates @aws-sdk/client-s3 and, on require of index.js, JSON-stringifies process.env together with hostname, username, home directory, platform, and current working directory,...

Malicious code in @zzzcrypto/xrp-lib (npm)

Source: amazon-inspector 781049b09ea0edc63ede63c8c559e3e9a08255982bbe6d18c2e4c0823b4fdf0c Package impersonates the legitimate xrpl library README: 'Drop-in replacement for xrpl'; author field 'XRPLF'; repo points to a non-existent XRPLF/xrp-lib. On require, index.js collects hostname, username,...

Malicious code in @zzzcrypto/etherjs (npm)

Source: amazon-inspector b2aebef684ec4affb6c5d0504179ef4e4f409bf6680cdd6d70772ec8f9b3bf35 @zzzcrypto/etherjs is a typosquat of the popular 'ethers' package. On require, index.js collects the full process.env object along with hostname, username, homedir, platform, cwd, and package identifiers,...

Malicious code in bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8981a1bdc42ac6f595b3805c959060201fc4eb0c39b5bf50b25c5d3d7cc398b5 [email protected] is a typosquat of bitcoinjs-lib that performs credential theft at module load. On require, index.js collects hostname, usernam...

MAL-2026-13258 Malicious code in bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8981a1bdc42ac6f595b3805c959060201fc4eb0c39b5bf50b25c5d3d7cc398b5 [email protected] is a typosquat of bitcoinjs-lib that performs credential theft at module load. On require, index.js collects hostname, usernam...

Malicious code in @zzzcrypto/xrp-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 781049b09ea0edc63ede63c8c559e3e9a08255982bbe6d18c2e4c0823b4fdf0c Package impersonates the legitimate xrpl library README: 'Drop-in replacement for xrpl'; author field 'XRPLF'; repo points to a non-existent...

MAL-2026-13212 Malicious code in @zzzcrypto/etherjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2aebef684ec4affb6c5d0504179ef4e4f409bf6680cdd6d70772ec8f9b3bf35 @zzzcrypto/etherjs is a typosquat of the popular 'ethers' package. On require, index.js collects the full process.env object along with hostname,...

MAL-2026-12123 Malicious code in @zzzgenesis00/solana-spl-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 985d4d8e5069084334daa08512249314d36d9fa8662adef050021c2400dacbdd @zzzgenesis00/[email protected] impersonates the Solana SPL Token package and runs postinstall.js on npm install. The script harvests host...

Malicious code in @wethenorth12/etherjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 723058bc35d3709a0c7e143d8e80357528319cc7b5e508174cd49295eaccb0f8 @wethenorth12/[email protected] is a typosquat of the ethers package package name, description, and author string 'ricmoo' all mimic the real package;...

MAL-2026-12100 Malicious code in @wethenorth12/solana-spl-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7dde46db2fbc17fae2957070f85bc43fdb1d265444f2e5adc936faa6f82e96e2 @wethenorth12/solana-spl-token is a typosquat of the legitimate @solana/spl-token package. On module load, index.js collects hostname, username, home...

MAL-2026-12094 Malicious code in @wethenorth12/ethers-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6460d1d0c9cc7423bb90aaf0b165fe45b3949fb627b33d817d34c1ffea64d3d8 The package presents itself as a drop-in replacement for the ethers library author metadata ethers-io, repository URL pointing at the legitimate ethe...

Malicious code in @wethenorth12/ethers-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6460d1d0c9cc7423bb90aaf0b165fe45b3949fb627b33d817d34c1ffea64d3d8 The package presents itself as a drop-in replacement for the ethers library author metadata ethers-io, repository URL pointing at the legitimate ethe...