OpenSSF/OSV advisory MAL-2026-12055 confirms this npm version as malicious. postinstall.js runs automatically on npm install and enumerates installer-side secret stores including ~/.ssh, ~/.npmrc, ~/.gitconfig, Chrome and Firefox profile paths, and cryptocurrency wallet directories, and collects a hardcoded list of secret environment variables (NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS keys, MNEMONIC, SEED_PHRASE, ETHEREUM_PRIVATE_KEY, and other API keys)...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @zzzgenesis00/docker-api-client (npm)
Details
postinstall.js runs automatically on npm install and enumerates installer-side secret stores including ~/.ssh, ~/.npmrc, ~/.gitconfig, Chrome and Firefox profile paths, and cryptocurrency wallet directories, and collects a hardcoded list of secret environment variables (NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS keys, MNEMONIC, SEED_PHRASE, ETHEREUM_PRIVATE_KEY, and other API keys). The harvested profile is transmitted at install time via HTTPS GET to api.telegram.org using a hardcoded bot token and chat_id, and via HTTPS POST /collect to 40f955f39128bd79-178-249-214-24.serveousercontent.com (a serveo reverse-tunnel host), with a randomized 1.5-3.5s delay. package.json declares author `apocas` and repository `github.com/apocas/docker-api-client`, impersonating the maintainer of the legitimate dockerode/docker-modem packages; the scoped name `@zzzgenesis00/docker-api-client` is unrelated to that author.
Decision reason
OpenSSF Malicious Packages via OSV confirms @zzzgenesis00/docker-api-client@2.0.2 as malicious (MAL-2026-12055): Malicious code in @zzzgenesis00/docker-api-client (npm)