Malicious code in mnemonic-to-key (npm)
The npm package mnemonic-to-key contained malicious code that exfiltrated sensitive environment variables (API tokens, cloud credentials, publish tokens) to a Telegram bot on first import. The package was positioned as a drop-in replacement for bip39 to target cryptocurrency developers.
- Disclosed
- Last updated
- Blast radius
- Developers and CI/CD environments using the mnemonic-to-key package; exfiltration of environment variables containing API tokens, cloud credentials, and publish tokens.
- Ecosystems
- Attack vectors
- Affected entities
- mnemonic-to-keynpm package; typosquat of bip39
The mnemonic-to-key npm package contained malicious code in its index.js that executed on require(). Upon import, the code serialized the full process.env object along with system metadata (hostname, username, homedir, platform, cwd), base64-encoded the JSON blob, and transmitted it via HTTPS GET request to api.telegram.org using a hardcoded Telegram bot token (7231970337) and chat_id (8969499041).\n\nThe package advertised itself as a drop-in replacement for the legitimate bip39 module and lazily re-exported bip39 when available, otherwise providing stub wallet and mnemonic functions. This positioning made it an effective typosquat targeting cryptocurrency developers.\n\nDeveloper and CI environments typically contain sensitive credentials in process.env, including API tokens, cloud credentials, and publish tokens. These were exfiltrated on first package import. A flag file under the OS tmpdir was used to suppress repeat transmissions.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- mnemonic-to-key
- Domains
- api.telegram.org
Remediation
- Immediately remove mnemonic-to-key from all projects and dependencies
- Audit process.env and rotate all API tokens, cloud credentials, and publish tokens that may have been exposed
- Review CI/CD logs for evidence of the package being imported
- Scan npm audit logs and package-lock.json files for presence of mnemonic-to-key
- Implement package name verification and typosquat detection in dependency management workflows
- Use npm audit and similar tools to identify and remove the malicious package
Sources
- GitHub Advisory GHSA-pr3h-gq23-9pmg · GitHub Advisory Database
Cite this entry
"Malicious code in mnemonic-to-key (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-mnemonic-to-key-npm-1l0q1d
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @aerodrome-finance/contracts (npm)
A malicious npm package named @aerodrome-finance/contracts was published, typosquatting the legitimate @aerodrome-finance scope. The package contained code that auto-executes on npm install, stealing credentials and environment variables from multiple locations and sending them to a hardcoded webhook endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in ethereum-vault-connector (npm)
A malicious npm package named ethereum-vault-connector impersonated Euler Labs' legitimate Ethereum Vault Connector project and distributed a Node.js credential stealer. The package automatically executed on install via preinstall and postinstall hooks, exfiltrating environment variables, SSH keys, AWS credentials, and other sensitive files to an external webhook.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in base65-12x (npm)
The npm package base65-12x is a typosquatting attack on the popular base-x library. It contains obfuscated malicious code that installs a VM-style dispatcher on globalThis with network fetch capabilities, executing unconditionally at module load time in both CommonJS and ESM contexts.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in base65-15x (npm)
base65-15x is a typosquat of the base-x npm package containing malicious code in its decode() function that exfiltrates caller-supplied arguments (including cryptographic secrets) to a hardcoded attacker-controlled IP endpoint via unencrypted HTTP.
npmTyposquattingCompromised package