Malicious code in @zzzgenesis00/bip39-mnemonic (npm)
The npm package @zzzgenesis00/bip39-mnemonic contained malicious postinstall code that impersonated the legitimate bitcoinjs/bip39 project and exfiltrated sensitive credentials, environment variables, SSH keys, and wallet artifacts to attacker-controlled endpoints via Telegram Bot API and a hardcoded URL.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed @zzzgenesis00/bip39-mnemonic via npm; potential exposure of credentials, tokens, SSH keys, and wallet secrets.
- Ecosystems
- Attack vectors
- Affected entities
- @zzzgenesis00/bip39-mnemonicMalicious npm package impersonating bitcoinjs/bip39
The @zzzgenesis00/bip39-mnemonic npm package was published with malicious intent, impersonating the legitimate bitcoinjs/bip39 project by setting the author field to 'bitcoinjs-lib'. Upon installation, a postinstall.js script executes automatically and performs extensive reconnaissance and credential harvesting.\n\nThe malicious script collects host and user identifiers, enumerates sensitive environment variables (NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS_* keys, and wallet-related secrets like PRIVATE_KEY, MNEMONIC, and SEED_PHRASE), reads configuration files (~/.npmrc, ~/.gitconfig), probes cryptocurrency wallet directories, and enumerates SSH keys. It also executes npm whoami and git config to gather additional context.\n\nCollected data is exfiltrated to two hardcoded destinations: a Telegram Bot API endpoint (with embedded bot token and chat ID 7231970337) and a POST request to 40f955f39128bd79-178-249-214-24.serveousercontent.com/collect. Exfiltration is delayed by a randomized timeout (1500–3500 ms) to evade detection. The module re-exports ./index.js to maintain a veneer of legitimacy.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository (MAL-2026-12030).
Indicators of compromise
- Packages
- @zzzgenesis00/bip39-mnemonic
- Domains
- 40f955f39128bd79-178-249-214-24.serveousercontent.com
Remediation
- Immediately uninstall @zzzgenesis00/bip39-mnemonic from all environments
- Rotate all credentials and tokens that may have been exposed (NPM_TOKEN, GITHUB_TOKEN, AWS keys, SSH keys, wallet seeds/mnemonics)
- Audit npm install logs and CI/CD pipelines for evidence of installation
- Review ~/.npmrc, ~/.gitconfig, and SSH key access logs for unauthorized activity
- Monitor Telegram Bot API and the hardcoded exfiltration endpoint for data breaches
- Use npm audit and supply chain security tools to detect similar typosquatting or impersonation packages
- Implement package verification and allowlisting policies in npm installations
Sources
- GitHub Advisory GHSA-cf5w-8hr5-cpff · GitHub Advisory Database
Cite this entry
"Malicious code in @zzzgenesis00/bip39-mnemonic (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-zzzgenesis00-bip39-mnemonic-npm-lhnjwm
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - containedcritical
Malicious code in axios-fast (npm)
axios-fast@1.0.1 on npm contains malicious code that exfiltrates environment variables (including AWS credentials, NPM tokens, and GitHub tokens) to an attacker-controlled webhook during package installation. The package typosquats the legitimate axios HTTP client library.
npmCompromised packageTyposquatting