MAL-2026-12113

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (cfb9c83260c4fb83a678636e1e1c028f2aff3e3c0a0ac13728cfa2056a13389f) This npm package, published under the well-known PyPI name `python-bitcoinlib`, ships a `postinstall.js` lifecycle script that runs automatically on `npm install`. The script reads classic installer secret paths including `~/.ssh/id_rsa`, `~/.aws/credentials`, `~/.npmrc`, `.env` files, and Solana/Ethereum wallet keystores (`~/.config/solana/id.json`), and additionally walks dotdirs under $HOME for files whose names match wallet/key/secret/seed/mnemonic/keystore/private patterns. The collected file contents, together with `os.hostname()` and `os.userInfo()`, are POSTed via `https.request` to a hardcoded webhook.site collector at `https://webhook.site/5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4`. The package name collides with the established PyPI `python-bitcoinlib` project but ships unrelated code on npm, indicating deliberate ecosystem-confusion typosquatting rather than a legitimate port.