# MAL-2026-3772: Malicious code in rimraf-utils (npm)


- **Type:** Malicious package
- **Package:** `rimraf-utils` (npm)
- **Published:** 14 May 2026

## What is MAL-2026-3772?

MAL-2026-3772 is a malicious package in rimraf-utils, published on 14 May 2026. 

### Official description

rimraf-utils@1.0.5 impersonates the widely-installed `rimraf` package (index.js is a dummy stub that internally identifies itself as 'lodash-js — Just a dummy module. The real payload is in postinstall.js'). On `npm install`, `scripts.postinstall` runs postinstall.js, which harvests installer-side secrets and ships them to a hardcoded bare-IP C2 over plaintext HTTP at `http://149.28.127.35:8888` (overridable via `process.env.C2_URL`).

Specific behavior in postinstall.js:
- Reads `~/.npmrc` (npm auth tokens), `~/.env` (API keys, DB URLs, cloud credentials, payment keys, EVM private keys, webhooks), and `~/.git-credentials`.
- Collects `os.hostname()` and `os.userInfo()` for host identification.
- Enumerates 71 hardcoded Chrome/Brave/Edge/Firefox crypto-wallet extension IDs (MetaMask, Phantom, Coinbase, Trust, Exodus, Ledger Live, Trezor, Solflare, etc.) under the browsers' profile directories and reads each wallet's LevelDB `.log` files, regex-extracting `vault`/`seed`/`mnemonic`/`privateKey`/`encrypted`/`password` fields.
- Recursively walks `~/Documents`, `~/Desktop`, `~/Downloads`, `~/OneDrive`, `~/Dropbox`, `~/Google Drive`, and `backup`/`keys`/`wallet`/`crypto` subtrees searching for seed-phrase and private-key patterns.
- POSTs the aggregated JSON payload to the C2 via `http.request(...)`.

This package matches multiple unambiguous attack fingerprints simultaneously: hardcoded bare-IP plaintext-HTTP C2 invoked from a lifecycle hook; browser crypto-wallet extension-ID enumeration; seed-phrase/mnemonic home-directory scanner; and installer-secret regex extraction from `~/.npmrc`/`~/.env`/`~/.git-credentials`. The name is a typosquat of `rimraf` used as the delivery vector for the payload.

## What should I do about MAL-2026-3772?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-3772 is a malicious package: rimraf-utils (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-3772/ (Markdown: https://insights.sbomify.com/MAL-2026-3772/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-3772

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-3772/
Summaries are generated and may contain mistakes; the official description above is the record.