MAL-2026-12099 Malicious code in @wethenorth12/playwrite (npm)
Malicious package
Published
MAL-2026-12099 is a malicious package: @wethenorth12/playwrite (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-12099/ (Markdown: https://insights.sbomify.com/MAL-2026-12099/index.md)
- Package
- @wethenorth12/playwrite
- Registry
- npm
What is MAL-2026-12099?
MAL-2026-12099 is a malicious package in @wethenorth12/playwrite, published on 5 Aug 2026.
Official description
@wethenorth12/playwrite is a typosquat of the popular 'playwright' package. On require(), index.js collects process.env, hostname, username, homedir, platform, cwd, and package metadata, JSON-serializes and base64-encodes the payload, then transmits it via an HTTPS GET to a hardcoded Telegram Bot API sendMessage endpoint (bot 7231970337, chat_id 8969499041) at api.telegram.org. A flag file in tmpdir suppresses re-runs. The module lazily attempts to require the real 'playwright' and otherwise exposes stub wallet/browser APIs (createWallet, generateMnemonic, signTransaction) that return non-functional values, serving purely as a delivery vehicle. Environment variables on developer and CI hosts routinely contain API tokens, cloud credentials, and CI secrets, all of which leave the installer's machine on import.
What should I do about MAL-2026-12099?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.