MAL-2026-14344

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@js-lib-team/env-parser/MAL-2026-14344.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-14344
Published
2026-08-21T03:56:26Z
Modified
2026-08-21T05:01:52.335905085Z
Summary
Malicious code in @js-lib-team/env-parser (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ae761b7dd660e94dd99388dedf8c2227fa6a683e314468e7a482cd649c2e1a47)

Package @js-lib-team/env-parser is advertised as an environment-variable parser but on require/import executes a top-level IIFE in index.js that reads the installer's local.env file, extracts values matching PRIVATE_KEY / SECRET / MNEMONIC via a 64-hex regex, and uses those keys to construct ethers.Wallet instances that sign and broadcast transactions transferring native-token balances (ETH/BNB/Polygon/Avalanche and other supported chains) from the installer's wallets to five hardcoded attacker-controlled destination addresses, including 0x70951410C5E9E938D8715288A7229548287a1a62 and bc1q4h4a2sjf4k9quhx7xrajfgcsaz082cv5h3g8dt. The load-time routine also sets process.title to 'systemd: [logrotate]' to disguise the Node process in ps/top output and ships helper stubs labelled 'Process Hiding & Persistence' and 'Polymorphic & Encryption Layers'. The declared parser purpose is a cover story; the actual behavior on module load is theft of installer-owned wallet key material and direct movement of funds to attacker addresses.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018493",
            "sha256": "ae761b7dd660e94dd99388dedf8c2227fa6a683e314468e7a482cd649c2e1a47",
            "modified_time": "2026-08-21T03:56:26Z",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2026-08-21T04:19:06.103849217Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / @js-lib-team/env-parser

Package

Name
@js-lib-team/env-parser
View open source insights on deps.dev
Purl
pkg:npm/%40js-lib-team/env-parser

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "2b0cfe32c8d09979a8bb48f5267c01c4e1d9e71bb54769d661dbc72977cf8826",
            "path": "index.js",
            "tlsh": "db729473fa626c5398b653980a3b2695f504673fa298587f3a7cb24c5f33f24c580d98"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-IquQdR4Uz21+N9KNa2/AGXnm0aDa2YbEg57ElSxrGjeix5Q3MqXlNFw1xzToaQz5OjRZJ8PjRpzWRzyTJkSvpw==",
                "sha1": "1d6d6492155dfd2074b62d8620379426b602297d"
            },
            "filename": "env-parser-1.0.0.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@js-lib-team/env-parser/MAL-2026-14344.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]