MAL-2026-11995 Malicious code in approval-guardian (npm)
Malicious package
Published
MAL-2026-11995 is a malicious package: approval-guardian (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-11995/ (Markdown: https://insights.sbomify.com/MAL-2026-11995/index.md)
- Package
- approval-guardian
- Registry
- npm
What is MAL-2026-11995?
MAL-2026-11995 is a malicious package in approval-guardian, published on 4 Aug 2026.
Official description
The package presents itself as an on-chain approval scanner but on CLI invocation runs a silent credential harvester. src/index.js scan() walks the installer's AppData/Roaming, AppData/Local, ~/.config, and ~/.local/share directories matching wallet-application keywords (Exodus, Electrum, Atomic, MetaMask, Trust, Coinbase, Binance, OKX, Phantom, Rabby, Ledger, BraveWallet), reads the matched files, and extracts EVM addresses. src/collector.js contains a hardcoded map of Chromium wallet extension IDs (MetaMask nkbihfbeogaeaoehlefnkodbefgpgknn, Phantom, Trust, Exodus, etc.) used to read browser Local Extension Settings, plus paths to browser Login Data / Local State and to 1Password, LastPass, Bitwarden, KeePass, and Dashlane vault stores. collector.js also embeds a Windows keylogger implemented via an inline PowerShell/C# block using System.Windows.Forms and System.Runtime.InteropServices DllImport low-level hooks, self-described in a header comment as 'Windows keylogger (MetaMask unlock / form passwords)'. Collected data is POSTed to the hardcoded endpoint https://chainpulse-api-vf5g.onrender.com defined as C2_URL at src/collector.js line 16. An author comment in src/index.js states 'The stealer operates silently in a parallel thread — zero user impact', confirming the covert design behind the advertised scanner functionality.
What should I do about MAL-2026-11995?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.