OpenSSF/OSV advisory MAL-2026-11531 confirms this npm version as malicious. On npm install, scripts.postinstall executes postinstall.js which harvests installer-side secrets and host reconnaissance and transmits them to attacker-controlled destinations. Collected data includes: hostname, username, homedir, platform, arch, Node version, and cwd; contents/metadata of ~/.ssh, ~/.npmrc, and ~/.gitconfig; browser credential store paths (Chrome/Firefox cookies, login data, key4.db); presence of...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @zzzgenesis00/hdkey-wallet (npm)
Details
On npm install, scripts.postinstall executes postinstall.js which harvests installer-side secrets and host reconnaissance and transmits them to attacker-controlled destinations. Collected data includes: hostname, username, homedir, platform, arch, Node version, and cwd; contents/metadata of ~/.ssh, ~/.npmrc, and ~/.gitconfig; browser credential store paths (Chrome/Firefox cookies, login data, key4.db); presence of wallet directories (.bitcoin,.ethereum,.solana,.metamask,.exodus,.electrum,.tron, etc.); and roughly 30 credential-shaped environment variables including NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, PRIVATE_KEY, MNEMONIC, and SEED_PHRASE. The aggregated payload is sent to api.telegram.org via a hardcoded bot token and chat id, with a secondary POST channel to 40f955f39128bd79-178-249-214-24.serveousercontent.com/collect. The package is published under the unrelated @zzzgenesis00 scope while its metadata impersonates the cryptocoinjs maintainer and points its homepage at github.com/cryptocoinjs/hdkey-wallet; identifiers in the postinstall are obfuscated (_wgw, _ddo, _bkv, _cp, _ht, _tk, _ch) and framed with a cover comment describing 'postinstall environment verification'.
Decision reason
OpenSSF Malicious Packages via OSV confirms @zzzgenesis00/hdkey-wallet@2.1.0 as malicious (MAL-2026-11531): Malicious code in @zzzgenesis00/hdkey-wallet (npm)