ledger-lib@1.0.2
Malicious code in ledger-lib (npm)
T1059.007 · JavaScriptT1082 · System Information DiscoveryT1552.001 · Credentials In FilesT1005 · Data from Local SystemT1041 · Exfiltration Over C2 ChannelT1071.001 · Web Protocols
Analysis
ledger-lib@1.0.2 runs a postinstall hook that steals the installer's credentials and cryptocurrency wallets. It reads ~/.env, ~/.npmrc, ~/.aws/credentials, ~/.ssh/id_rsa, ~/.config/solana/id.json, and ~/.ethereum/keystore, then recursively scans the home directory for files matching wallet/key/secret/seed/mnemonic/keystore/private or ending in .json/.pem, and POSTs the collected data as JSON to hxxps://webhook[.]site/5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4. The package name impersonates the Ledger wallet brand.
- analyzed by
- Leitwacht
- first seen
- Aug 5, 2026, 02:06 AM
- analyzed
- Aug 5, 2026, 02:06 AM
Related advisories
- mnemonic-utils@1.0.1
- emulative@1.0.1
- stellarfixer@1.0.0
- simple-date-formatter-new-4@1.0.0
- simple-date-formatter-util-15@1.0.0
- simple-date-formatter-util-14@1.0.0
- simple-date-formatter-util-13@1.0.0
- simple-date-formatter-util-8@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.