{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "2b0cfe32c8d09979a8bb48f5267c01c4e1d9e71bb54769d661dbc72977cf8826",
              "tlsh": "db729473fa626c5398b653980a3b2695f504673fa298587f3a7cb24c5f33f24c580d98"
            }
          ],
          "package_integrity": [
            {
              "filename": "env-parser-1.0.0.tgz",
              "hashes": {
                "sha1": "1d6d6492155dfd2074b62d8620379426b602297d",
                "sha512_sri": "sha512-IquQdR4Uz21+N9KNa2/AGXnm0aDa2YbEg57ElSxrGjeix5Q3MqXlNFw1xzToaQz5OjRZJ8PjRpzWRzyTJkSvpw=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@js-lib-team/env-parser"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-018493",
        "import_time": "2026-08-21T04:19:06.103849217Z",
        "modified_time": "2026-08-21T03:56:26Z",
        "sha256": "ae761b7dd660e94dd99388dedf8c2227fa6a683e314468e7a482cd649c2e1a47",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ae761b7dd660e94dd99388dedf8c2227fa6a683e314468e7a482cd649c2e1a47)\nPackage @js-lib-team/env-parser is advertised as an environment-variable parser but on require/import executes a top-level IIFE in index.js that reads the installer\u0027s local.env file, extracts values matching PRIVATE_KEY / SECRET / MNEMONIC via a 64-hex regex, and uses those keys to construct ethers.Wallet instances that sign and broadcast transactions transferring native-token balances (ETH/BNB/Polygon/Avalanche and other supported chains) from the installer\u0027s wallets to five hardcoded attacker-controlled destination addresses, including 0x70951410C5E9E938D8715288A7229548287a1a62 and bc1q4h4a2sjf4k9quhx7xrajfgcsaz082cv5h3g8dt. The load-time routine also sets process.title to \u0027systemd: [logrotate]\u0027 to disguise the Node process in ps/top output and ships helper stubs labelled \u0027Process Hiding \u0026 Persistence\u0027 and \u0027Polymorphic \u0026 Encryption Layers\u0027. The declared parser purpose is a cover story; the actual behavior on module load is theft of installer-owned wallet key material and direct movement of funds to attacker addresses.\n",
  "id": "MAL-2026-14344",
  "modified": "2026-08-21T03:56:26Z",
  "published": "2026-08-21T03:56:26Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@js-lib-team/env-parser/v/1.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @js-lib-team/env-parser (npm)"
}