Malicious code in @zzzgenesis00/mnemonic-to-key (npm)
The npm package @zzzgenesis00/mnemonic-to-key contained a malicious postinstall script that exfiltrated sensitive credentials and secrets from developer machines and CI/CD environments. The script harvested SSH keys, npm tokens, GitHub tokens, AWS credentials, wallet private keys, and browser data, sending them to attacker-controlled Telegram and serveousercontent.com endpoints.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed @zzzgenesis00/mnemonic-to-key via npm
- Ecosystems
- Attack vectors
- Affected entities
- @zzzgenesis00/mnemonic-to-keynpm package containing malicious postinstall script
The npm package @zzzgenesis00/mnemonic-to-key was found to contain malicious code in its postinstall.js script. Upon installation, the script executed automatically and enumerated sensitive files and credentials from the installer's system.
The malicious script collected a wide range of sensitive data including: SSH private keys from ~/.ssh, npm credentials from ~/.npmrc, git configuration from ~/.gitconfig, browser profile data (cookies, login data, encryption keys) from Chrome, Chromium, and Firefox, and cryptocurrency wallet directories (.bitcoin, .ethereum, .solana, .metamask, .exodus, .electrum, and similar). It also executed npm whoami and git config user.email commands and read credential-shaped environment variables such as NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS keys, MNEMONIC, SEED_PHRASE, ETHEREUM_PRIVATE_KEY, and WALLET_PRIVATE_KEY.
The collected data was exfiltrated via HTTPS GET requests to api.telegram.org using a hardcoded bot token and chat ID, with a backup POST mechanism to a hardcoded serveousercontent.com subdomain at path /collect. The postinstall file was obfuscated with a module.exports = require('./index.js') passthrough and a misleading header comment describing it as environment verification. Exfiltration was delayed with a randomized 1.5–3.5 second timer to execute after normal install output completed, reducing visibility.
The package's advertised functionality (mnemonic-to-key conversion) was unrelated to the malicious behavior. The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- @zzzgenesis00/mnemonic-to-key
- Domains
- api.telegram.org
- serveousercontent.com
Remediation
- Immediately uninstall @zzzgenesis00/mnemonic-to-key from all systems and CI/CD pipelines
- Rotate all credentials that may have been exposed: npm tokens, GitHub tokens, AWS keys, SSH keys, and any cryptocurrency wallet private keys
- Review and revoke any browser cookies and stored credentials from affected machines
- Audit git and npm configuration files for unauthorized changes
- Check Telegram and serveousercontent.com logs for evidence of data exfiltration
- Implement npm package scanning and verification in CI/CD pipelines to detect malicious postinstall scripts
- Use npm audit and supply chain security tools to identify other potentially compromised dependencies
- Consider using npm package lockfiles and integrity verification to prevent unexpected package modifications
Sources
- GitHub Advisory GHSA-65q9-wff6-3r9m · GitHub Advisory Database
Cite this entry
"Malicious code in @zzzgenesis00/mnemonic-to-key (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-zzzgenesis00-mnemonic-to-key-npm-1revyk
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit