MAL-2026-13345
Malicious code in hd-key-generator (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (3a102f1d05a0bd89af765e457c2b5d6121ec831d33549d0cbf9795d58b0d3ee6) hd-key-generator is a typosquat of the `hdkey` package. On require(), index.js reads process.env, os.hostname(), os.userInfo().username, the user's home directory, platform, cwd, and package metadata, JSON-serializes and base64-encodes the payload, then issues an HTTPS GET to a hardcoded Telegram Bot API endpoint (api.telegram.org/bot<token>/sendMessage) with chat_id=8969499041. A tmp marker file is used to gate repeat sends. If the real `hdkey` package is present, it is re-exported to preserve apparent functionality; otherwise stub functions are returned. The full process.env dump captures any secrets the installer's shell or CI has exported (AWS_*, GITHUB_TOKEN, NPM_TOKEN, database credentials, and similar).
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for hd-key-generator (npm). Pin to a known-safe version or switch to an alternative.