🛡️ MAL-2026-12119 — bitcoinjs-wallet
Description
Malicious code in @zzzgenesis00/bitcoinjs-wallet (npm)
Source: amazon-inspector
This package is a typosquat of the bitcoinjs-wallet ecosystem. Its index.js is a thin passthrough while the malicious behavior is in postinstall.js, which runs automatically on npm install. The postinstall script enumerates ~/.ssh, ~/.npmrc, ~/.gitconfig, Chrome/Chromium/Firefox profile paths (Cookies, Login Data, key4.db, logins.json), and a curated list of cryptocurrency wallet directories (.bitcoin,.ethereum,.metamask,.exodus,.electrum, and others). It also reads credential-shaped environment variables including NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY, PRIVATE_KEY, MNEMONIC, SEED_PHRASE, and ETHEREUM_PRIVATE_KEY. It shells out to npm whoami and git config --global user.email via child_process.execSync to tag the harvested data with the developer's identity. The collected profile is transmitted via two channels: a GET to api.telegram.org using a hardcoded bot token (7231970337) and chat_id, and a POST to /collect on the serveo tunnel host 40f955f39128bd79-178-249-214-24.serveousercontent.com. Exfiltration is delayed via setTimeout with a randomized 1500-3500 ms window and wrapped in an 'environment verification' cover-story comment to blend with normal install activity.
Affected software
MAL-2026-12119 is recorded against 1 package.
- @zzzgenesis00/bitcoinjs-wallet
Timeline and source
Published on 5 August 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.
References
Details
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| @zzzgenesis00/bitcoinjs-wallet | — | — |
References
Free Vulnerability Check
Is your site affected by MAL-2026-12119?
BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against MAL-2026-12119 and other known CVE records.
Scan My Site Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.