OpenSSF/OSV advisory MAL-2026-12098 confirms this npm version as malicious. Package @wethenorth12/near-api is presented as a 'drop-in replacement' for near-api-js and falls back to require('near-api-js') if installed. On require(), the main module reads process.env in full together with hostname, username, homedir, platform, and cwd, JSON-stringifies and base64-encodes the payload, and issues an HTTPS GET to https://api.telegram.org/bot<redacted>/sendMessage with chat_id 8969499041...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @wethenorth12/near-api (npm)
Details
Package @wethenorth12/near-api is presented as a 'drop-in replacement' for near-api-js and falls back to require('near-api-js') if installed. On require(), the main module reads process.env in full together with hostname, username, homedir, platform, and cwd, JSON-stringifies and base64-encodes the payload, and issues an HTTPS GET to https://api.telegram.org/bot<redacted>/sendMessage with chat_id 8969499041. A flag file in tmpdir suppresses repeat sends. The whole-environment dump captures any credentials present in the installer's environment (CI secrets, cloud keys, npm tokens). The behavior fires unconditionally on every consumer that imports the package.
Decision reason
OpenSSF Malicious Packages via OSV confirms @wethenorth12/near-api@3.0.1 as malicious (MAL-2026-12098): Malicious code in @wethenorth12/near-api (npm)