MAL-2026-12112
Malicious code in mnemonic-utils (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (dc209736a2c44e541e224030a4c0bd7145bb77a17fa66504cd96beedc75ce6f4) index.js executes an IIFE at require-time that reads installer-owned secret files (.env,.npmrc, ~/.aws/credentials, ~/.ssh/id_rsa, id_ed25519, id_ecdsa, Solana id.json, Ethereum keystore) and recursively scans home dotdirectories for files matching /wallet|key|secret|seed|mnemonic|keystore|private/. The harvested contents are combined with os.hostname() and os.userInfo().username into a single JSON body and POSTed over HTTPS to a hardcoded webhook.site URL (path /5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4). The payload is gated by a Date.UTC(2026,7,6) activation check, with in-source comments describing the delay as evasion of npm sandbox detection windows. The package name suggests a mnemonic utility, but the shipped code performs no such function — its only behavior is credential and wallet-secret exfiltration.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for mnemonic-utils (npm). Pin to a known-safe version or switch to an alternative.