b20miner@0.3.1
OpenSSF/OSV Malicious Advisory
imported 7d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18365 confirms this npm version as malicious.
Advisory
MAL-2026-18365
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in b20miner (npm)
Details
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
References
Independent LPM AI assessment
Manual ReviewIndependent AI assessment: manual_review. LPM AI review remains unresolved.
The package launches platform-specific native executables during mining, and the available analyses could not resolve their behavior. No independent source evidence establishes an attack, so manual review is needed.
Static reason
No blocking static signals were detected.
Trigger
A user invokes the mining command on a platform with a matching native hasher.
Impact
Unknown because the native executables' behavior could not be assessed.
Mechanism
The CLI selects and launches that native executable; available offline analyses could not determine what it does.
AI rationale
The package launches platform-specific native executables during mining, and the available analyses could not resolve their behavior. No independent source evidence establishes an attack, so manual review is needed.
Evidence
.lpm-inspection-tu2Pvv/0-0f579ee8f374.txt.lpm-inspection-tu2Pvv/1-8cbb241f6962.txtnative/prebuilt/darwin-x64/b20miner-hashernative/prebuilt/darwin-arm64/b20miner-hasher
Independent scan evidence
public snapshotAI called this Manual Review at 88.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package exposes dist/main.js as its command-line entrypoint.
- Mining selects the platform-specific native hasher and runs it as a child process.
- The x64 native artifact analysis could not determine the executable's behavior.
- The arm64 native artifact analysis could not determine the executable's behavior.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggednative/prebuilt/darwin-x64/b20miner-hasherView file
•path = native/prebuilt/darwin-x64/b20miner-hasher
kind = native_binary
sizeBytes = 17320
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
native/prebuilt/darwin-x64/b20miner-hasherView on unpkgpackage.jsonView file
7"b20miner": "dist/main.js"
},
"files": [
"dist",
"native/hasher.c",
"native/prebuilt",
"README.md",
High
Ai Review Evidence
The package exposes dist/main.js as its command-line entrypoint.
package.jsonView on unpkg · L7dist/hasher.jsView file
37const prebuilt = join(NATIVE_DIR, "prebuilt", `${process.platform}-${process.arch}`, `b20miner-hasher${EXE}`);
const local = join(NATIVE_DIR, `b20miner-hasher${EXE}`);
const cached = join(home
Findings
5 High3 Medium4 Low
HighAi Review Evidencepackage.json
HighAi Review Evidencedist/hasher.js
HighAi Review Evidencedist/hasher.js
HighAi Review Evidence.lpm-inspection-tu2Pvv/0-0f579ee8f374.txt
HighAi Review Evidence.lpm-inspection-tu2Pvv/1-8cbb241f6962.txt
MediumEnvironment Vars
MediumShips Native Binarynative/prebuilt/darwin-x64/b20miner-hasher
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to b20miner@0.3.1.
See all versions of b20miner for other recorded verdicts.
- Avoid installing b20miner@0.3.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.