🛡️ MAL-2026-13213 — playwrite

Malicious code in @zzzcrypto/playwrite (npm)

Source: amazon-inspector

On require() of @zzzcrypto/playwrite, index.js harvests the installer's full process.env plus hostname, username, homedir, platform, cwd, and package identity, base64-encodes the payload, and issues an HTTPS GET to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot<redacted>/sendMessage?chat_id=8969499041) with the encoded data in the text query parameter. A tmpdir flag file guards against repeat sends. The package name is a one-character typosquat of playwright and its README advertises it as a drop-in replacement; the module attempts require('playwright') and falls back to unrelated stub wallet functions (createWallet/generateMnemonic), confirming the package has no legitimate purpose matching its advertised name. Full process.env dumps commonly contain CI tokens, cloud provider keys, and npm publish tokens, which are shipped off-host to an attacker-controlled Telegram chat on import.