# MAL-2026-12122: Malicious code in @zzzgenesis00/near-api (npm)


- **Type:** Malicious package
- **Package:** `@zzzgenesis00/near-api` (npm)
- **Published:** 5 Aug 2026

## What is MAL-2026-12122?

MAL-2026-12122 is a malicious package in @zzzgenesis00/near-api, published on 5 Aug 2026. 

### Official description

The package's postinstall.js lifecycle script runs on `npm install` and collects installer-side secrets: it enumerates a hardcoded list of credential-shaped environment variables (NPM_TOKEN, NODE_AUTH_TOKEN, GITHUB_TOKEN, AWS_*, MNEMONIC, SEED_PHRASE, ETHEREUM_PRIVATE_KEY, and other API keys), reads ~/.ssh, ~/.npmrc, and ~/.gitconfig, probes Chrome/Firefox profiles and cryptocurrency wallet directories (.metamask,.exodus,.electrum,.ethereum,.solana), and runs `npm whoami` and `git config`. The collected bundle is POSTed to two hardcoded attacker-controlled destinations: api.telegram.org via a hardcoded bot token and chat_id, and a Serveo reverse-tunnel host at 40f955f39128bd79-178-249-214-24.serveousercontent.com/collect. Execution is deferred with `setTimeout(1500 + Math.random()*2000)` and errors are swallowed; variable names are obfuscated (_jag, _jui, _tk, _ch) and the script is labeled 'postinstall environment verification' as cover. `module.exports = require('./index.js')` provides passthrough so consumers see near-api-like behavior. The package name typosquats NEAR Protocol's official near-api package.

## What should I do about MAL-2026-12122?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-12122 is a malicious package: @zzzgenesis00/near-api (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-12122/ (Markdown: https://insights.sbomify.com/MAL-2026-12122/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-12122

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-12122/
Summaries are generated and may contain mistakes; the official description above is the record.