MAL-2026-15638 Malicious code in test__123q2 (npm)
Malicious package
Published
MAL-2026-15638 is a malicious package: test__123q2 (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-15638/ (Markdown: https://insights.sbomify.com/MAL-2026-15638/index.md)
- Package
- test__123q2
- Registry
- npm
What is MAL-2026-15638?
MAL-2026-15638 is a malicious package in test__123q2, published on 31 Aug 2026.
Official description
On npm install, the package's postinstall script sweeps the installer's home directory for crypto wallet and credential material and uploads it to an attacker-controlled Telegram bot. Targets include browser wallet extension profiles for MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), Phantom, Trust, Coinbase, OKX, Rabby, Keplr, TronLink, Ronin, Solflare and Exodus; desktop wallets Exodus, Atomic, Electrum, Bitcoin Core (wallet.dat), Ledger Live, Trezor Suite, Wasabi, Sparrow, Guarda, Coinomi and Jaxx; and files under Desktop, Documents, Downloads and Projects matching mnemonic/seed/bip39/privatekey keywords plus.env,.npmrc,.netrc, id_rsa and ~/.aws material. Collected files are tarballed via the
tar dependency and POSTed as a document to a hardcoded Telegram Bot API endpoint (https://api.telegram.org/bot<BOT_TOKEN>/sendDocument); the destination is not user-configurable. The package name and version carry no legitimate functionality that would justify this behavior.What should I do about MAL-2026-15638?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.