🛡️ MAL-2026-12113 — python-bitcoinlib

Malicious code in python-bitcoinlib (npm)

Source: amazon-inspector

This npm package, published under the well-known PyPI name python-bitcoinlib, ships a postinstall.js lifecycle script that runs automatically on npm install. The script reads classic installer secret paths including ~/.ssh/id_rsa, ~/.aws/credentials, ~/.npmrc, .env files, and Solana/Ethereum wallet keystores (~/.config/solana/id.json), and additionally walks dotdirs under $HOME for files whose names match wallet/key/secret/seed/mnemonic/keystore/private patterns. The collected file contents, together with os.hostname() and os.userInfo(), are POSTed via https.request to a hardcoded webhook.site collector at https://webhook.site/5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4. The package name collides with the established PyPI python-bitcoinlib project but ships unrelated code on npm, indicating deliberate ecosystem-confusion typosquatting rather than a legitimate port.