MAL-2026-6522 - Vulnerability-Lookup

MAL-2026-6522 (GHSA-X7JG-W433-8Q2R)

Vulnerability from ossf_malicious_packages – Published: 2026-06-26 14:13 – Updated: 2026-06-29 03:27 – Source website

Malicious package

Summary

Malicious code in @epsteinlovekids483/crossmint-wallets-sdk-pentest (npm)

Affected package

Ecosystem	Package	Versions
npm	`@epsteinlovekids483/crossmint-wallets-sdk-pentest`	Affected: All versions (semver) 1.0.2-pentest1.0.1-pentest1.0.0-pentest1.0.9-pentest1.0.5-pentest1.0.7-pentest1.0.11-pentest1.0.11

Details

Amazon Inspector IN-MAL-2026-007602 Reported 2026-06-26 14:13

Package's main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code harvests installer secrets — filtered process.env keys matching TOKEN/KEY/SECRET/PASS/SEED/MNEMONIC/WALLET/PRIVATE/CREDENTIAL/AWS/AZURE/GCP/STRIPE/SLACK/TWILIO/NPM/GITHUB, the output of gh auth token invoked via child_process.execSync, ~/.npmrc, ~/.aws/credentials, ~/.ssh/* private keys, and ~/.config/solana/id.json. The collected data is JSON-stringified, base64-encoded, and POSTed (HTTPS with TLS validation disabled, HTTP fallback) to a hardcoded endpoint at 127.0.0.1:8052/exfil that the source comments label as 'C2'. The package is published under @epsteinlovekids483/crossmint-wallets-sdk-pentest, declares the legitimate Crossmint repository and the 'Paella Labs Inc' author, and ships a copied Crossmint Wallets SDK README, while internal comments state the payload is 'Injected into @crossmint/wallets-sdk'. The loopback C2 in this published build limits immediate reach on a vanilla installer, but the harvest, encoding, and POST primitives execute on every require() and the destination is a one-line change for any future republish. Importing this package as the legitimate Crossmint SDK results in theft of AWS credentials, SSH private keys, npm auth tokens, Solana keypairs, and the GitHub CLI token.

GitHub Advisory Database GHSA-x7jg-w433-8q2r Reported 2026-06-29 02:21

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Amazon Inspector IN-MAL-2026-007601 Reported 2026-06-26 14:13

No description from this source.

Amazon Inspector IN-MAL-2026-007600 Reported 2026-06-26 14:13

No description from this source.

Amazon Inspector IN-MAL-2026-007632 Reported 2026-06-26 15:49

No description from this source.

Amazon Inspector IN-MAL-2026-007631 Reported 2026-06-26 15:49

No description from this source.

Amazon Inspector IN-MAL-2026-007634 Reported 2026-06-26 15:49

No description from this source.

Amazon Inspector IN-MAL-2026-007633 Reported 2026-06-26 15:49

No description from this source.

Amazon Inspector IN-MAL-2026-007641 Reported 2026-06-26 16:35

No description from this source.

Indicators

2 evidence file, 1 package archive

Type	Indicator	Hashes
Evidence file	`dist/shai-hulud.js`	sha256 `0010cbed18b4cd78968ccc4de5b73f4f04d713099fb47f2fe12c600992a9f47d` tlsh `eb4188d026e68228169752e069df5011b273f50b3c41f0f476d89e5f6f8da5895b38f8`
Evidence file	`package.json`	sha256 `1597a5fc1b7f1cd479ff2a9941f5753fb176d07b98d9af03be2ebbf6a31a35d5` tlsh `40318b14c0154e6346c8279558b54123a6a24f0b4d96b91e33eb411d8f8df9f22ff2ef`
Package archive	`crossmint-wallets-sdk-pentest-1.0.2-pentest.tgz`	sha1 `2a706ca0ab37c842c67c78742521c081f54abd85` sha512_sri `sha512-AEGdojNF+TCl/63x//lFx8K2rix/hcVeRhL5v/fjp67h+N3KtTXhxAzHh9InElOwkiWg/Z4uwzc/9ECV5ILWrQ==`

CWE

CWE-506 - Embedded Malicious Code

Credits

Amazon Inspector inspector-research@amazon.com

References

9 references

URL	Tags
https://www.npmjs.com/package/@epsteinlovekids483…	PACKAGE
https://www.npmjs.com/package/@epsteinlovekids483…	PACKAGE
https://www.npmjs.com/package/@epsteinlovekids483…	PACKAGE
https://www.npmjs.com/package/@epsteinlovekids483…	PACKAGE
https://www.npmjs.com/package/@epsteinlovekids483…	PACKAGE
https://www.npmjs.com/package/@epsteinlovekids483…	PACKAGE
https://www.npmjs.com/package/@epsteinlovekids483…	PACKAGE
https://www.npmjs.com/package/@epsteinlovekids483…	PACKAGE
https://github.com/advisories/GHSA-x7jg-w433-8q2r	ADVISORY

{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dist/shai-hulud.js",
              "sha256": "0010cbed18b4cd78968ccc4de5b73f4f04d713099fb47f2fe12c600992a9f47d",
              "tlsh": "eb4188d026e68228169752e069df5011b273f50b3c41f0f476d89e5f6f8da5895b38f8"
            },
            {
              "path": "package.json",
              "sha256": "1597a5fc1b7f1cd479ff2a9941f5753fb176d07b98d9af03be2ebbf6a31a35d5",
              "tlsh": "40318b14c0154e6346c8279558b54123a6a24f0b4d96b91e33eb411d8f8df9f22ff2ef"
            }
          ],
          "package_integrity": [
            {
              "filename": "crossmint-wallets-sdk-pentest-1.0.2-pentest.tgz",
              "hashes": {
                "sha1": "2a706ca0ab37c842c67c78742521c081f54abd85",
                "sha512_sri": "sha512-AEGdojNF+TCl/63x//lFx8K2rix/hcVeRhL5v/fjp67h+N3KtTXhxAzHh9InElOwkiWg/Z4uwzc/9ECV5ILWrQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@epsteinlovekids483/crossmint-wallets-sdk-pentest"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": [
        "1.0.2-pentest",
        "1.0.1-pentest",
        "1.0.0-pentest",
        "1.0.9-pentest",
        "1.0.5-pentest",
        "1.0.7-pentest",
        "1.0.11-pentest",
        "1.0.11"
      ]
    }
  ],
  "aliases": [
    "GHSA-x7jg-w433-8q2r"
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007601",
        "import_time": "2026-06-26T14:59:21.082180218Z",
        "modified_time": "2026-06-26T14:13:42Z",
        "sha256": "0ca13667904a02cf13ab6827aa545065e594da3d8d196785351e7aff11ab3d9a",
        "source": "amazon-inspector",
        "versions": [
          "1.0.2-pentest"
        ]
      },
      {
        "id": "IN-MAL-2026-007600",
        "import_time": "2026-06-26T14:59:21.049245258Z",
        "modified_time": "2026-06-26T14:13:39Z",
        "sha256": "1df7116664455c448e5139b1ffac280a1f863853a707070c4336faff5f547015",
        "source": "amazon-inspector",
        "versions": [
          "1.0.1-pentest"
        ]
      },
      {
        "id": "IN-MAL-2026-007602",
        "import_time": "2026-06-26T14:59:21.107580496Z",
        "modified_time": "2026-06-26T14:13:44Z",
        "sha256": "6e43e5a418541bb3e485010eba536ecc9f1483dba866af53ff4a760684409213",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0-pentest"
        ]
      },
      {
        "id": "IN-MAL-2026-007632",
        "import_time": "2026-06-26T15:52:37.802354507Z",
        "modified_time": "2026-06-26T15:49:07Z",
        "sha256": "af6fd83887b81c26da22239653f2ba5bcfd1595d45b3f1106f206bcfd5880003",
        "source": "amazon-inspector",
        "versions": [
          "1.0.9-pentest"
        ]
      },
      {
        "id": "IN-MAL-2026-007631",
        "import_time": "2026-06-26T15:52:37.77365884Z",
        "modified_time": "2026-06-26T15:49:04Z",
        "sha256": "ebf8f9d3677453259809d52d4b8e69591e8e12989363e98e7dbb8867fdbe7f6e",
        "source": "amazon-inspector",
        "versions": [
          "1.0.5-pentest"
        ]
      },
      {
        "id": "IN-MAL-2026-007634",
        "import_time": "2026-06-26T15:52:37.878438244Z",
        "modified_time": "2026-06-26T15:49:09Z",
        "sha256": "16f956e213ce0351e5350b1b7b6d998d2e9ed7d6dae05a17d1923fe309c477fa",
        "source": "amazon-inspector",
        "versions": [
          "1.0.7-pentest"
        ]
      },
      {
        "id": "IN-MAL-2026-007633",
        "import_time": "2026-06-26T15:52:37.846062601Z",
        "modified_time": "2026-06-26T15:49:08Z",
        "sha256": "1b9999c6315e7c670597d99525bf8f2855ff61499c08b649ae185bf1ff75e836",
        "source": "amazon-inspector",
        "versions": [
          "1.0.11-pentest"
        ]
      },
      {
        "id": "IN-MAL-2026-007641",
        "import_time": "2026-06-26T16:45:37.047948605Z",
        "modified_time": "2026-06-26T16:35:48Z",
        "sha256": "362265d8096cedca8dbb8fcfe9319112a2c7ce61bd4798fa12953998f822a560",
        "source": "amazon-inspector",
        "versions": [
          "1.0.11"
        ]
      },
      {
        "id": "GHSA-x7jg-w433-8q2r",
        "import_time": "2026-06-29T03:26:14.380240607Z",
        "modified_time": "2026-06-29T02:21:20Z",
        "ranges": [
          {
            "events": [
              {
                "introduced": "0"
              }
            ],
            "type": "SEMVER"
          }
        ],
        "sha256": "1850618fdd57bee05073c1ad031b8551ea08b949bdd10c0e956b8db6f32a123e",
        "source": "ghsa-malware"
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6e43e5a418541bb3e485010eba536ecc9f1483dba866af53ff4a760684409213)\nPackage\u0027s main entry (dist/index.cjs) unconditionally requires dist/shai-hulud.js at module load. On require(), the code harvests installer secrets \u2014 filtered process.env keys matching TOKEN/KEY/SECRET/PASS/SEED/MNEMONIC/WALLET/PRIVATE/CREDENTIAL/AWS/AZURE/GCP/STRIPE/SLACK/TWILIO/NPM/GITHUB, the output of `gh auth token` invoked via child_process.execSync, ~/.npmrc, ~/.aws/credentials, ~/.ssh/* private keys, and ~/.config/solana/id.json. The collected data is JSON-stringified, base64-encoded, and POSTed (HTTPS with TLS validation disabled, HTTP fallback) to a hardcoded endpoint at 127.0.0.1:8052/exfil that the source comments label as \u0027C2\u0027. The package is published under @epsteinlovekids483/crossmint-wallets-sdk-pentest, declares the legitimate Crossmint repository and the \u0027Paella Labs Inc\u0027 author, and ships a copied Crossmint Wallets SDK README, while internal comments state the payload is \u0027Injected into @crossmint/wallets-sdk\u0027. The loopback C2 in this published build limits immediate reach on a vanilla installer, but the harvest, encoding, and POST primitives execute on every require() and the destination is a one-line change for any future republish. Importing this package as the legitimate Crossmint SDK results in theft of AWS credentials, SSH private keys, npm auth tokens, Solana keypairs, and the GitHub CLI token.\n\n## Source: ghsa-malware (1850618fdd57bee05073c1ad031b8551ea08b949bdd10c0e956b8db6f32a123e)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n",
  "id": "MAL-2026-6522",
  "modified": "2026-06-29T03:27:51Z",
  "published": "2026-06-26T14:13:39Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@epsteinlovekids483/crossmint-wallets-sdk-pentest/v/1.0.2-pentest"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@epsteinlovekids483/crossmint-wallets-sdk-pentest/v/1.0.1-pentest"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@epsteinlovekids483/crossmint-wallets-sdk-pentest/v/1.0.0-pentest"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@epsteinlovekids483/crossmint-wallets-sdk-pentest/v/1.0.9-pentest"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@epsteinlovekids483/crossmint-wallets-sdk-pentest/v/1.0.5-pentest"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@epsteinlovekids483/crossmint-wallets-sdk-pentest/v/1.0.7-pentest"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@epsteinlovekids483/crossmint-wallets-sdk-pentest/v/1.0.11-pentest"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@epsteinlovekids483/crossmint-wallets-sdk-pentest/v/1.0.11"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-x7jg-w433-8q2r"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @epsteinlovekids483/crossmint-wallets-sdk-pentest (npm)"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.