OpenSSF/OSV advisory MAL-2026-12097 confirms this npm version as malicious. Package advertises itself as a drop-in replacement for bip39 and exposes stub wallet functions (createWallet, generateMnemonic) to attract wallet-handling projects. On module load, index.js reads the full process.env dictionary along with hostname, username, home directory, platform, and cwd, JSON-encodes and base64-encodes the payload, and transmits it as a URL query parameter to a hardcoded Telegram Bot API...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @wethenorth12/mnemonic-to-key (npm)
Details
Package advertises itself as a drop-in replacement for bip39 and exposes stub wallet functions (createWallet, generateMnemonic) to attract wallet-handling projects. On module load, index.js reads the full process.env dictionary along with hostname, username, home directory, platform, and cwd, JSON-encodes and base64-encodes the payload, and transmits it as a URL query parameter to a hardcoded Telegram Bot API sendMessage endpoint (bot 7231970337, chat 8969499041). A temporary flag file is written to suppress repeated sends. Environment variables in developer and CI environments routinely contain cloud credentials, npm/GitHub tokens, and database secrets, so the require-time beacon is a direct credential-theft channel controlled by the package author.
Decision reason
OpenSSF Malicious Packages via OSV confirms @wethenorth12/mnemonic-to-key@1.2.0 as malicious (MAL-2026-12097): Malicious code in @wethenorth12/mnemonic-to-key (npm)