🛡️ MAL-2026-12118 — bitcoin-lib

Malicious code in @zzzgenesis00/bitcoin-lib (npm)

Source: amazon-inspector

@zzzgenesis00/bitcoin-lib 6.1.7 runs a postinstall.js at npm install time that harvests installer-owned secrets and exfiltrates them to attacker-controlled destinations. The script enumerates ~/.ssh, reads ~/.npmrc and ~/.gitconfig, inventories Chrome/Firefox cookie and login stores, scans cryptocurrency wallet directories (.bitcoin,.ethereum,.metamask, Exodus, Electrum, and others), and captures a curated list of credential-shaped environment variables including NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS_*, *_PRIVATE_KEY, MNEMONIC, and SEED_PHRASE. Collected data is JSON-serialized and sent, after a short setTimeout delay, via GET to api.telegram.org/bot<TOKEN>/sendMessage with a hardcoded chat_id and via POST /collect to 40f955f39128bd79-178-249-214-24.serveousercontent.com. The package.json falsely attributes authorship to 'bitcoinjs' and points the repository at github.com/bitcoinjs/bitcoin-lib, impersonating the well-known bitcoinjs organization while shipping under the unrelated @zzzgenesis00 scope.