MAL-2026-12090 Malicious code in @wethenorth12/docker-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae39aac54233ee3235e2cb94f52d5d4e182a6f16d91ac42b9d7add9bd8c00470 Package advertises itself as a 'drop-in replacement for dockerode' but the main module index.js has no Docker functionality. On require, it collects...

Malicious code in @wethenorth12/bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94f602036ff9f524298056528fbec6c58c9fb66ea2686bec418694b5854aeea4 On require, index.js collects the full process.env object together with hostname, username, home directory, platform, current working directory, and ...

MAL-2026-12088 Malicious code in @wethenorth12/bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94f602036ff9f524298056528fbec6c58c9fb66ea2686bec418694b5854aeea4 On require, index.js collects the full process.env object together with hostname, username, home directory, platform, current working directory, and ...

Malicious code in @wethenorth12/web3-utils-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc6591661338a325995ebe471f7d8157c1be9458f38336c4c11032033b150108 On module load, index.js collects the host identifiers os.hostname, os.userInfo.username, home directory, platform, cwd and the entire process.env,...

MAL-2026-12107 Malicious code in @wethenorth12/web3-utils-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc6591661338a325995ebe471f7d8157c1be9458f38336c4c11032033b150108 On module load, index.js collects the host identifiers os.hostname, os.userInfo.username, home directory, platform, cwd and the entire process.env,...

MAL-2026-12100 Malicious code in @wethenorth12/solana-spl-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7dde46db2fbc17fae2957070f85bc43fdb1d265444f2e5adc936faa6f82e96e2 @wethenorth12/solana-spl-token is a typosquat of the legitimate @solana/spl-token package. On module load, index.js collects hostname, username, home...

Malicious code in @wethenorth12/playwrite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e208f50bb22bacadd2c6debf8e973a50ba3a59db74e9c618fa28202eac96a64 @wethenorth12/playwrite is a typosquat of the popular 'playwright' package. On require, index.js collects process.env, hostname, username, homedir,...

Malicious code in @wethenorth12/spl-token-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d7f9cee39cc030c866ec58a0744ef387333cf5578a35f4b10aa211c19c61b7b @wethenorth12/spl-token-utils advertises itself as a drop-in replacement for @solana/spl-token. On require, index.js serializes the full process.env...

Malicious code in @wethenorth12/ethers-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6460d1d0c9cc7423bb90aaf0b165fe45b3949fb627b33d817d34c1ffea64d3d8 The package presents itself as a drop-in replacement for the ethers library author metadata ethers-io, repository URL pointing at the legitimate ethe...

MAL-2026-12094 Malicious code in @wethenorth12/ethers-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6460d1d0c9cc7423bb90aaf0b165fe45b3949fb627b33d817d34c1ffea64d3d8 The package presents itself as a drop-in replacement for the ethers library author metadata ethers-io, repository URL pointing at the legitimate ethe...

MAL-2026-12093 Malicious code in @wethenorth12/ethers-signer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb90f0b593abd4ce67cca9ba5adf891758c8d205b023d87986460471a9ab721e On require, index.js collects the host's hostname, username, home directory, platform, current working directory, and the entire process.env,...

Malicious code in @wethenorth12/hdkey-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e9eb2c497323415e826c9de190e636c2dea959708898550db20676d0c1ae6da index.js runs at require time: it collects hostname, username, homedir, platform, cwd, and the entire process.env, JSON-serializes and base64-encodes...

Malicious code in @wethenorth12/near-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec76b158cd4b27bb2e90a492c1713c1655dcbd2f4a9fc0f03a0664d8bec8e2ed Package @wethenorth12/near-api is presented as a 'drop-in replacement' for near-api-js and falls back to require'near-api-js' if installed. On requir...

Malicious code in @wethenorth12/web3-provider-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f54c89c6e669f4a9e1e2939e09b5ac809507f98df451e239add607d417f394a Package name mimics MetaMask's official web3-provider-engine and its README advertises a drop-in replacement, but the exported API...

MAL-2026-12106 Malicious code in @wethenorth12/web3-provider-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f54c89c6e669f4a9e1e2939e09b5ac809507f98df451e239add607d417f394a Package name mimics MetaMask's official web3-provider-engine and its README advertises a drop-in replacement, but the exported API...

Malicious code in @wethenorth12/mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c373b3f6b1c60d079fb7c63d13a51f7e42ee41feeff2c04c5ab925ad5dad41fb Package advertises itself as a drop-in replacement for bip39 and exposes stub wallet functions createWallet, generateMnemonic to attract...

Malicious code in crypto-wallet-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d0bf047680c46c2f4c37c8a7b77e9d993acb05ef4925c660e0c5cccf95be581f During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

MAL-2026-12083 Malicious code in crypto-wallet-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d0bf047680c46c2f4c37c8a7b77e9d993acb05ef4925c660e0c5cccf95be581f During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

MAL-2026-12082 Malicious code in crypto-trading-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 20c37efbefbfb1922a205d954cdb5666103fd3e343a67e89dc19694ad5b64ef0 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in crypto-trading-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 20c37efbefbfb1922a205d954cdb5666103fd3e343a67e89dc19694ad5b64ef0 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...