Malicious code in mnemonic-to-key (npm)
The npm package mnemonic-to-key contained malicious code that exfiltrated sensitive environment variables (API tokens, cloud credentials, publish tokens) to a Telegram bot on first import. The package was positioned as a drop-in replacement for bip39 to target cryptocurrency developers.
- Disclosed
- Last updated
- Blast radius
- Developers and CI/CD environments using the mnemonic-to-key package; exfiltration of environment variables containing API tokens, cloud credentials, and publish tokens.
- Ecosystems
- Attack vectors
- Affected entities
- mnemonic-to-keynpm package; typosquat of bip39
The mnemonic-to-key npm package contained malicious code in its index.js that executed on require(). Upon import, the code serialized the full process.env object along with system metadata (hostname, username, homedir, platform, cwd), base64-encoded the JSON blob, and transmitted it via HTTPS GET request to api.telegram.org using a hardcoded Telegram bot token (7231970337) and chat_id (8969499041).\n\nThe package advertised itself as a drop-in replacement for the legitimate bip39 module and lazily re-exported bip39 when available, otherwise providing stub wallet and mnemonic functions. This positioning made it an effective typosquat targeting cryptocurrency developers.\n\nDeveloper and CI environments typically contain sensitive credentials in process.env, including API tokens, cloud credentials, and publish tokens. These were exfiltrated on first package import. A flag file under the OS tmpdir was used to suppress repeat transmissions.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- mnemonic-to-key
- Domains
- api.telegram.org
Remediation
- Immediately remove mnemonic-to-key from all projects and dependencies
- Audit process.env and rotate all API tokens, cloud credentials, and publish tokens that may have been exposed
- Review CI/CD logs for evidence of the package being imported
- Scan npm audit logs and package-lock.json files for presence of mnemonic-to-key
- Implement package name verification and typosquat detection in dependency management workflows
- Use npm audit and similar tools to identify and remove the malicious package
Sources
- GitHub Advisory GHSA-pr3h-gq23-9pmg · GitHub Advisory Database
Cite this entry
"Malicious code in mnemonic-to-key (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-mnemonic-to-key-npm-1l0q1d
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - containedcritical
Malicious code in axios-fast (npm)
axios-fast@1.0.1 on npm contains malicious code that exfiltrates environment variables (including AWS credentials, NPM tokens, and GitHub tokens) to an attacker-controlled webhook during package installation. The package typosquats the legitimate axios HTTP client library.
npmCompromised packageTyposquatting