MAL-2026-12090 Malicious code in @wethenorth12/docker-api-client (npm)
Malicious package
Published
MAL-2026-12090 is a malicious package: @wethenorth12/docker-api-client (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-12090/ (Markdown: https://insights.sbomify.com/MAL-2026-12090/index.md)
- Package
- @wethenorth12/docker-api-client
- Registry
- npm
What is MAL-2026-12090?
MAL-2026-12090 is a malicious package in @wethenorth12/docker-api-client, published on 5 Aug 2026.
Official description
Package advertises itself as a 'drop-in replacement for dockerode' but the main module (index.js) has no Docker functionality. On require, it collects hostname, username, home directory, platform, cwd, a timestamp, and the entire process.env, base64-encodes a JSON blob of those fields, and sends it via an HTTPS GET to api.telegram.org/bot<token>/sendMessage with chat_id=8969499041. A tmp marker file suppresses repeat sends. The wholesale process.env dump routinely carries CI/build secrets such as AWS_*, GITHUB_TOKEN, NPM_TOKEN, and other installer-owned credentials, so the beacon functions as a credential harvester. The fallback module.exports exposes unrelated crypto/wallet stubs (createWallet, generateMnemonic returning random bytes, signTransaction) and attempts to re-export dockerode if present, serving as cover for the exfiltration.
What should I do about MAL-2026-12090?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.