# MAL-2026-13695: Malicious code in hex-encode-utils (npm)


- **Type:** Malicious package
- **Package:** `hex-encode-utils` (npm)
- **Published:** 10 Aug 2026

## What is MAL-2026-13695?

MAL-2026-13695 is a malicious package in hex-encode-utils, published on 10 Aug 2026. 

### Official description

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility (published by the npm account `devroolx` under the repo github.com/stdlib-utils/hex-encode-utils). It is a multi-stage downloader/loader that runs automatically on install via a `postinstall` hook (`node runtime.js`).

runtime.js first gates execution to real developer machines: it only proceeds if the user home directory contains a Desktop, Documents, or Downloads folder, and caches a timestamp at `~/.cache/hex-encode-utils/.runtime_check` to run at most once every 24 hours (sandbox/CI evasion and low-noise persistence). It then exfiltrates host reconnaissance (hostname, username, platform and architecture, Node.js version, OS release, package version, and timestamp) via an HTTPS POST to `/report` on the attacker-controlled Cloudflare Worker `steel-mere-4155.ricardorichp.workers.dev`.

It next downloads an AES-256-GCM encrypted blob from `/e` on the same host, decrypts it with a key derived as the SHA-256 of a hardcoded seed string that is disguised as a Bitcoin "BIP-0174 PSBT version 2 signing specification for hardware wallets" reference (indicating cryptocurrency-wallet targeting), and validates that the decrypted payload is Python source containing a `TelemetrySender` class. It locates a Python interpreter (python3/python and version-specific fallbacks), writes the decrypted payload to `~/.cache/hex-encode-utils/modules/runtime.py`, builds an `exec_runtime.py` wrapper that invokes `TelemetrySender.send(TelemetrySender.load())`, and spawns it as a detached, output-suppressed background Python process (`detached: true`, `stdio: 'ignore'`, `.unref()`). All C2 traffic disables TLS certificate validation (`rejectUnauthorized: false`).

The second-stage Python payload is fetched at runtime from attacker infrastructure and was not available for static analysis; based on the wallet/PSBT-signing themed key seed it most likely targets cryptocurrency wallet material. Any host that installed this package should be treated as compromised: remove `~/.cache/hex-encode-utils`, hunt for the spawned Python process, and rotate any wallet keys and secrets reachable from the affected machine.

On npm install, scripts/compat.js runs as a postinstall hook and fetches an AES-256-GCM-encrypted blob over HTTPS from two hardcoded Cloudflare Workers hosts (steel-mere-4155.ricardorichp.workers.dev, cold-peak-7969.0x0gnx0.workers.dev) with TLS verification disabled (rejectUnauthorized: false), decrypts it with a hardcoded key derived from a 'BIP-0174' decoy string, writes the plaintext to ~/.cache/hex-encode-utils/modules/exec_runtime.py, and spawns a detached, stdio-ignored Python process to execute it. Before dropping the payload the script POSTs an install beacon to /r on the same Workers host carrying the installer's hostname (os.hostname()), username (os.userInfo()), platform/arch (os.platform()), Node version, and package version, formatted as an HTML Telegram message with chat_id 6087129674 for relay to a Telegram bot. Execution is gated by sandbox-evasion checks that abort in CI/container environments (CI, GITHUB_ACTIONS, DOCKER_CONTAINER, KUBERNETES_SERVICE_HOST) and require Desktop/Documents/Downloads directories under $HOME to confirm a developer workstation. Comments frame the code as a next.js/nuxt-style compatibility shim. The package's stated purpose (hex encode/decode) has no legitimate need for postinstall network I/O, encrypted-payload fetch, Python execution, or host reconnaissance to a Telegram relay.

## What should I do about MAL-2026-13695?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-13695 is a malicious package: hex-encode-utils (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-13695/ (Markdown: https://insights.sbomify.com/MAL-2026-13695/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-13695

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-13695/
Summaries are generated and may contain mistakes; the official description above is the record.