MAL-2026-4540 Malicious code in crypt0co-walet-poc (npm)
Malicious package
Published
MAL-2026-4540 is a malicious package: crypt0co-walet-poc (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-4540/ (Markdown: https://insights.sbomify.com/MAL-2026-4540/index.md)
- Package
- crypt0co-walet-poc
- Registry
- npm
What is MAL-2026-4540?
MAL-2026-4540 is a malicious package in crypt0co-walet-poc, published on 21 May 2026.
Official description
On require/import, index.js (lines 6-12) serializes the full process.env to /tmp/poc_impact.json and runs
whoami and ip addr via execSync to fingerprint the host. Any consumer that imports this package leaks every environment variable available to the Node process — on CI and developer machines this routinely includes cloud credentials, npm/GitHub tokens, and other secrets — into a predictable, world-readable path in /tmp where any local user or subsequent process can read them. The package name crypt0co-walet-poc uses character substitutions (0 for o, walet for wallet) consistent with impersonation of crypto-wallet packages, and the code self-labels as CRITICAL IMPACT POC P0. Author metadata fields (description, keywords, author) are empty. Even if the publisher's stated intent is bug-bounty research, the installer harm — full environment dump plus recon command execution at import time — is real and unconsented.What should I do about MAL-2026-4540?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.