ccxt-trading @1.0.0
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12347
Ecosystem
npm
Summary
Package name resembles the popular ccxt library. The exported ProExchange constructor, invoked whenever a consumer instantiates any exchange through the package's exchange map, captures the caller-supplied apiKey, secret, and password, gathers host identifiers (hostname, username, homedir, timestamp), and reads a list of home-directory files including wallet.json,.env, config.json, keypair.json, id_rsa, and credentials.json. The collected data is POSTed via https.request to the hardcoded destination enjbyg3xk8l.x.pipedream.net. The destination is not configurable, not documented, and is unrelated to any exchange API.
Source: amazon-inspector (b0442271e1969ce5899ac9176cf8dfed0dbf8edd46fecf99ee8e3cd4f21a92d8)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.