Malicious code in @zzzgenesis00/mnemonic-to-key (npm)
The npm package @zzzgenesis00/mnemonic-to-key contained a malicious postinstall script that exfiltrated sensitive credentials and secrets from developer machines and CI/CD environments. The script harvested SSH keys, npm tokens, GitHub tokens, AWS credentials, wallet private keys, and browser data, sending them to attacker-controlled Telegram and serveousercontent.com endpoints.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed @zzzgenesis00/mnemonic-to-key via npm
- Ecosystems
- Attack vectors
- Affected entities
- @zzzgenesis00/mnemonic-to-keynpm package containing malicious postinstall script
The npm package @zzzgenesis00/mnemonic-to-key was found to contain malicious code in its postinstall.js script. Upon installation, the script executed automatically and enumerated sensitive files and credentials from the installer's system.
The malicious script collected a wide range of sensitive data including: SSH private keys from ~/.ssh, npm credentials from ~/.npmrc, git configuration from ~/.gitconfig, browser profile data (cookies, login data, encryption keys) from Chrome, Chromium, and Firefox, and cryptocurrency wallet directories (.bitcoin, .ethereum, .solana, .metamask, .exodus, .electrum, and similar). It also executed npm whoami and git config user.email commands and read credential-shaped environment variables such as NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS keys, MNEMONIC, SEED_PHRASE, ETHEREUM_PRIVATE_KEY, and WALLET_PRIVATE_KEY.
The collected data was exfiltrated via HTTPS GET requests to api.telegram.org using a hardcoded bot token and chat ID, with a backup POST mechanism to a hardcoded serveousercontent.com subdomain at path /collect. The postinstall file was obfuscated with a module.exports = require('./index.js') passthrough and a misleading header comment describing it as environment verification. Exfiltration was delayed with a randomized 1.5–3.5 second timer to execute after normal install output completed, reducing visibility.
The package's advertised functionality (mnemonic-to-key conversion) was unrelated to the malicious behavior. The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @zzzgenesis00/mnemonic-to-key
- Domains
- api.telegram.org
- serveousercontent.com
Remediation
- Immediately uninstall @zzzgenesis00/mnemonic-to-key from all systems and CI/CD pipelines
- Rotate all credentials that may have been exposed: npm tokens, GitHub tokens, AWS keys, SSH keys, and any cryptocurrency wallet private keys
- Review and revoke any browser cookies and stored credentials from affected machines
- Audit git and npm configuration files for unauthorized changes
- Check Telegram and serveousercontent.com logs for evidence of data exfiltration
- Implement npm package scanning and verification in CI/CD pipelines to detect malicious postinstall scripts
- Use npm audit and supply chain security tools to identify other potentially compromised dependencies
- Consider using npm package lockfiles and integrity verification to prevent unexpected package modifications
Sources
- GitHub Advisory GHSA-65q9-wff6-3r9m · GitHub Advisory Database
Cite this entry
"Malicious code in @zzzgenesis00/mnemonic-to-key (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-zzzgenesis00-mnemonic-to-key-npm-1revyk
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in supersig (npm)
The supersig npm package contains malicious code in its published dist bundles (dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js) that is absent from the source tree. The bundles execute a decrypt-and-execute chain at load time using a DES key from an unpinned mkb-manager dependency, allowing remote code execution on any consumer.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in zyr-agent (npm)
zyr-agent (npm) shipped with malicious code that enables remote command execution through a hardcoded preview-slug endpoint controlled by the package author. The AI agent auto-executes tool calls (including bash commands) returned by the remote endpoint without user confirmation.
npmAI agents & skillsMalicious commitCompromised package - resolvedcritical
Malicious code in stretchshop (npm)
The npm package stretchshop@0.7.5 contained malicious code in its postinstall hook that cloned an external repository from a personal GitHub account and executed arbitrary JavaScript during installation. The vulnerability allowed the controller of the external repository to execute code on every fresh install of the affected version.
npmCompromised packageMalicious commit - containedcritical
Malicious code in gpt-terminal-cli (npm)
gpt-terminal-cli, an npm package advertised as an AI chat CLI, contains malicious code that installs a persistent remote access implant with extensive capabilities including reverse shell, credential theft, keylogging, and antiforensics. The implant communicates with a hardcoded C2 server and supports dynamic C2 rotation via DNS dead-drop.
npmCompromised packageMalicious commit