farming-tools-12

GHSA-xrx2-7wfp-6c7h

Malicious code in farming-tools-12 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 4.68.54`

Crypto/SSH/wallet stealer, blockchain-helper-0 campaign sibling (c960+), same aicrypto-xzggg publisher and "Core utilities for blockchain development" description as swap-sdk-87/defi-tools-39. postinstall auto-execs, src/index.js harvests ~/.ssh keys + Sol/Eth/BTC/Tron/Sui/Aptos wallets + .env + seeds, self-labels "CRYPTO STEALER", exfils to SAME Telegram bot 8227918239 chat 6433587894 (not rotated). Inflated version (4.68.54).## Source: amazon-inspector (1a40867051c796d19f9e375a3f07f7cb616aaaa75fb51d557ea7c1ae0fbbd790)
On install (postinstall hook requires src/index.js), the package enumerates installer-side secrets — ~/.ssh/id_rsa and id_ed25519, ~/.config/solana/id.json, Ethereum keystore files, Bitcoin wallet.dat, Tron/Sui/Aptos wallet files,.env, mnemonic.txt, seed.txt — and uploads each found file to api.telegram.org/bot<token>/sendDocument using a hardcoded bot token (8227918239:AAGE...) and chat_id (6433587894). Hostname and username are also sent in a message labeled 'CRYPTO STEALER' for victim attribution. Execution is gated by anti-analysis checks (CI=true, GITHUB_ACTIONS, JENKINS_HOME, NODE_ENV=test, usernames matching runner/sandbox/docker, 12-hex docker container hostnames) and delayed by setTimeout(7434) so it fires only on real developer machines. The author's own message label confirms malicious intent.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/51780a768dd5e4c4dbb3bdd3cf5931e0ba1644f6/osv/malicious/npm/farming-tools-12/MAL-2026-5357.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/51780a768dd5e4c4dbb3bdd3cf5931e0ba1644f6/osv/malicious/npm/farming-tools-12/MAL-2026-5357.json
- https://www.npmjs.com/package/farming-tools-12/v/4.68.54
- https://github.com/advisories/GHSA-xrx2-7wfp-6c7h

Compromised versions (1)

= 4.68.54

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.