hwi-lib@1.0.2
Malicious code in hwi-lib (npm)
Analysis
hwi-lib@1.0.2 runs a postinstall hook that harvests the installer's credentials and exfiltrates them. On install it reads ~/.env, ~/.npmrc, ~/.aws/credentials, SSH private keys (~/.ssh/id_rsa, id_ed25519, id_ecdsa), the Solana wallet (~/.config/solana/id.json) and Ethereum keystore (~/.ethereum/keystore), then recursively scans every hidden directory in the home folder for files matching wallet/key/secret/seed/mnemonic/keystore/private or ending in .json/.pem. It bundles the hostname, username, and all collected file contents into a JSON payload and POSTs it over HTTPS to webhook[.]site/5c5ad6cb-62df-4ea5-9dfb-2c447920ddc4. The package ships no real library code.
- analyzed by
- Leitwacht
- first seen
- Aug 5, 2026, 02:06 AM
- analyzed
- Aug 5, 2026, 02:07 AM
Related advisories
- ckcc-protocol@1.0.2
- trezor-lib@1.0.2
- ledger-lib@1.0.2
- mnemonic-utils@1.0.1
- emulative@1.0.1
- stellarfixer@1.0.0
- simple-date-formatter-new-4@1.0.0
- simple-date-formatter-util-15@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.