@zzzgenesis00/docker-api-client @2.0.2
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:00 AM UTC
OSV ID
MAL-2026-12055
Ecosystem
npm
Summary
postinstall.js runs automatically on npm install and enumerates installer-side secret stores including ~/.ssh, ~/.npmrc, ~/.gitconfig, Chrome and Firefox profile paths, and cryptocurrency wallet directories, and collects a hardcoded list of secret environment variables (NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS keys, MNEMONIC, SEED_PHRASE, ETHEREUM_PRIVATE_KEY, and other API keys). The harvested profile is transmitted at install time via HTTPS GET to api.telegram.org using a hardcoded bot token and chat_id, and via HTTPS POST /collect to 40f955f39128bd79-178-249-214-24.serveousercontent.com (a serveo reverse-tunnel host), with a randomized 1.5-3.5s delay. package.json declares author apocas and repository github.com/apocas/docker-api-client , impersonating the maintainer of the legitimate dockerode/docker-modem packages; the scoped name @zzzgenesis00/docker-api-client is unrelated to that author.
Source: amazon-inspector (2417f0620e130c16865914c5f79fdff63bdda0daf3257955c8fd536ab894c1b1)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.