MAL-2026-12067 Malicious code in hwi-lib (npm)
- Package
- hwi-lib
- Registry
- npm
What is MAL-2026-12067?
MAL-2026-12067 is a malicious package in hwi-lib, published on 5 Aug 2026.
Official description
hwi-lib@1.0.1 ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads installer credential files (~/.aws/credentials, ~/.ssh/id_rsa, id_ed25519, id_ecdsa, ~/.npmrc, ~/.gitconfig, ~/.config/solana/id.json, ~/.ethereum/keystore,.env variants) and walks hidden subdirectories of the user's home directory reading any file matching wallet|key|secret|seed|mnemonic|keystore|private or ending in.json/.pem/.key. The collected contents are POSTed via https.request to the hardcoded endpoint https://enxhcjpo5ev.x.pipedream.net/c. Package name and 'crypto utility' description impersonate the HWI (Hardware Wallet Interface) tooling while the shipped module exports nothing, indicating a lure.
The OpenSSF Package Analysis project identified 'hwi-lib' @ 1.0.1 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
What should I do about MAL-2026-12067?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.