mal-2026-13687
Vulnerability from ossf_malicious_packages
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6)
On module load, tokocrytodev instantiates a StealthC2 agent and starts a polling loop that fetches commands from https://badai.run.place/cekapppiapi.php?uid=, passes each response body to child_process.exec, and POSTs AES-256-ECB-encrypted stdout/stderr back to https://badai.run.place/fallback.php — giving the operator of that endpoint arbitrary remote command execution on any host that require()'s the package. In parallel, stealKeysAsync shells out find over /root/.ssh, /home//.ssh, /opt/wallet-keys, /etc/ssl/private, ~/.ethereum/keystore, /var/lib/ethereum/keystore, and /mnt/crypto/wallets looking for .pem, .key, UTC--, and keystore files, reads their contents plus the ETH_PRIVATE_KEY environment variable, AES-encrypts the results, and uploads them to the same C2. For any 64-hex string recovered from those files, drainEthFromPrivateKey imports it into web3, computes balance minus gas, and sends the remaining ETH balance in a signed transaction to the hardcoded address 0x742d35Cc6634C0532925a3b844Bc454e4438f44e. Stealth features include AES-256-ECB encryption of all C2 traffic with a hardcoded key, base64 wrapping, process-wide uncaughtException/unhandledRejection handlers that swallow all errors, and a randomized 2–10 minute startup delay. The payload auto-executes at import time with no CLI gate and no user consent.
{
"affected": [
{
"database_specific": {
"cwes": [
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
},
{
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature.",
"name": "Embedded Malicious Code"
}
],
"indicators": {
"evidence_files": [
{
"path": "index.js",
"sha256": "fd2296a3d972a05750609bbb1e0eb8c150e9edfd7819056b08b781cabb1f98f6",
"tlsh": "aa0256551efb542006e3f4e9ab6b6006e137e10f7a45ddd87f4c57408f8a42846aebf8"
}
],
"package_integrity": [
{
"filename": "tokocrytodev-1.0.0.tgz",
"hashes": {
"sha1": "1b14f7fe21cda47171ce4ae39847db34787e9052",
"sha512_sri": "sha512-OoWC9Dlj5bSfU/gGlk0h/hRZYpIpOyqMPV5DdjJuj2Dvz0StWt9id8EEzWo6ul/RWy0ZLUWO8/5BEXyQW2HIag=="
}
}
]
}
},
"package": {
"ecosystem": "npm",
"name": "tokocrytodev"
},
"versions": [
"1.0.0",
"1.0.1"
]
}
],
"credits": [
{
"contact": [
"inspector-research@amazon.com"
],
"name": "Amazon Inspector",
"type": "FINDER"
}
],
"database_specific": {
"malicious-packages-origins": [
{
"id": "IN-MAL-2026-017206",
"import_time": "2026-08-10T11:51:54.769328893Z",
"modified_time": "2026-08-10T11:50:11Z",
"sha256": "09fa98b6fd8313abbfeb250d10c12db28975f7bb12742f56dd5f1a3e1959d6d1",
"source": "amazon-inspector",
"versions": [
"1.0.0"
]
},
{
"id": "IN-MAL-2026-017974",
"import_time": "2026-08-15T18:45:40.258381663Z",
"modified_time": "2026-08-15T18:10:09Z",
"sha256": "88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6",
"source": "amazon-inspector",
"versions": [
"1.0.1"
]
}
]
},
"details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6)\nOn module load, tokocrytodev instantiates a StealthC2 agent and starts a polling loop that fetches commands from https://badai.run.place/cekapppiapi.php?uid=\u003chost-id\u003e, passes each response body to child_process.exec, and POSTs AES-256-ECB-encrypted stdout/stderr back to https://badai.run.place/fallback.php \u2014 giving the operator of that endpoint arbitrary remote command execution on any host that require()\u0027s the package. In parallel, stealKeysAsync shells out `find` over /root/.ssh, /home/*/.ssh, /opt/wallet-keys, /etc/ssl/private, ~/.ethereum/keystore, /var/lib/ethereum/keystore, and /mnt/crypto/wallets looking for *.pem, *.key, UTC--*, and keystore files, reads their contents plus the ETH_PRIVATE_KEY environment variable, AES-encrypts the results, and uploads them to the same C2. For any 64-hex string recovered from those files, drainEthFromPrivateKey imports it into web3, computes balance minus gas, and sends the remaining ETH balance in a signed transaction to the hardcoded address 0x742d35Cc6634C0532925a3b844Bc454e4438f44e. Stealth features include AES-256-ECB encryption of all C2 traffic with a hardcoded key, base64 wrapping, process-wide uncaughtException/unhandledRejection handlers that swallow all errors, and a randomized 2\u201310 minute startup delay. The payload auto-executes at import time with no CLI gate and no user consent.\n",
"id": "MAL-2026-13687",
"modified": "2026-08-15T18:47:27.437709768Z",
"published": "2026-08-10T11:50:11Z",
"references": [
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/tokocrytodev/v/1.0.0"
},
{
"type": "PACKAGE",
"url": "https://www.npmjs.com/package/tokocrytodev/v/1.0.1"
}
],
"schema_version": "1.7.4",
"summary": "Malicious code in tokocrytodev (npm)"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.