debugcli@4.3.4
Malicious code in debugcli (npm)
Analysis
debugcli@4.3.4 is a combosquat of the popular 'debug' package. On install, the postinstall hook (install.js) collects environment variables matching token/secret patterns (AWS_, GITHUB_, NPM_, STRIPE, OPENAI, ANTHROPIC, and 25+ others), reads credential files from ~/.aws/credentials, ~/.npmrc, ~/.git-credentials, ~/.kube/config, ~/.docker/config.json, ~/.ssh/config, ~/.netrc, ~/.pypirc, and .env files, and extracts Chrome extension vaults for MetaMask and TrustWallet. All stolen data is exfiltrated via the Telegram Bot API (hardcoded bot token and chat ID in install.js) as a text summary, a gzipped JSON dump, and wallet archives. The package's index.js is a decoy that simply re-exports the legitimate 'debug' module.
- analyzed by
- Leitwacht
- first seen
- Jul 3, 2026, 07:58 PM
- analyzed
- Jul 3, 2026, 07:59 PM
Related advisories
- date-fns-lite@1.0.6
- nat-ulid@3.0.2
- check-ulid@3.0.2
- web3-core-utils@4.3.5
- textdecode@1.2.7
- svg2text@3.0.0
- shadcn-ui-autocomplete@3.5.0
- polymarket-gamma-apis@1.4.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.