OpenSSF/OSV advisory MAL-2026-12095 confirms this npm version as malicious. @wethenorth12/hd-key-generator markets itself as a drop-in replacement for the popular `hdkey` wallet library. On require, index.js reads the full process.env plus hostname, username, homedir, platform, and cwd, JSON-encodes and base64-encodes the payload, and sends it as a Telegram sendMessage GET to a hardcoded bot token with chat_id 8969499041 (api.telegram.org/bot<redacted>/sendMessage)...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @wethenorth12/hd-key-generator (npm)
Details
@wethenorth12/hd-key-generator markets itself as a drop-in replacement for the popular `hdkey` wallet library. On require, index.js reads the full process.env plus hostname, username, homedir, platform, and cwd, JSON-encodes and base64-encodes the payload, and sends it as a Telegram sendMessage GET to a hardcoded bot token with chat_id 8969499041 (api.telegram.org/bot<redacted>/sendMessage). A tmp marker file is written to suppress repeated sends. Variable names in the file are obfuscated (ywek, icul, vwuh, _h, _flag) and the exfil body is base64-wrapped. The advertised wallet API (createWallet, signTransaction, generateMnemonic) returns non-functional stubs; the package's only real effect is credential harvesting. In developer and CI environments, process.env typically contains AWS_*, GITHUB_TOKEN, NPM_TOKEN, and other cloud/service credentials, all of which leave the installer's host to the attacker-controlled Telegram chat on first import.
Decision reason
OpenSSF Malicious Packages via OSV confirms @wethenorth12/hd-key-generator@1.6.3 as malicious (MAL-2026-12095): Malicious code in @wethenorth12/hd-key-generator (npm)