@zzzgenesis00/env-loader @4.2.0
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12120
Ecosystem
npm
Summary
On npm install, postinstall.js reads installer-owned secret material — ~/.ssh entries, ~/.npmrc, ~/.gitconfig — and iterates a curated list of credential and wallet environment variables (NPM_TOKEN, GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY, PRIVATE_KEY, MNEMONIC, SEED_PHRASE, ETHEREUM/BITCOIN/SOLANA/TRON_PRIVATE_KEY, WALLET_PRIVATE_KEY, API_KEY, etc.), enumerates Chrome/Firefox profile artifacts (Cookies, Login Data) and wallet directories, and runs npm whoami and git config user.email to identify the host. The collected payload is JSON-encoded and transmitted to two hardcoded, attacker-controlled destinations: a Telegram Bot API endpoint (api.telegram.org/bot<redacted>/sendMessage) and an HTTP POST to 40f955f39128bd79-178-249-214-24.servousercontent.com/collect. The package presents itself as a dotenv alternative and exports a stub wallet API (generateMnemonic, createWallet, signTransaction returning random bytes) as a cover story; the block-worthy behavior is the install-time credential theft in postinstall.js.
Source: amazon-inspector (cfbfc9bcbea1e1b9d6c52e2585bf5b28064fe8e38fe53304450fe1fd19340f3b)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.