@wethenorth12/playwrite

MAL-2026-12099

Malicious code in @wethenorth12/playwrite (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (8e208f50bb22bacadd2c6debf8e973a50ba3a59db74e9c618fa28202eac96a64)
@wethenorth12/playwrite is a typosquat of the popular 'playwright' package. On require(), index.js collects process.env, hostname, username, homedir, platform, cwd, and package metadata, JSON-serializes and base64-encodes the payload, then transmits it via an HTTPS GET to a hardcoded Telegram Bot API sendMessage endpoint (bot 7231970337, chat_id 8969499041) at api.telegram.org. A flag file in tmpdir suppresses re-runs. The module lazily attempts to require the real 'playwright' and otherwise exposes stub wallet/browser APIs (createWallet, generateMnemonic, signTransaction) that return non-functional values, serving purely as a delivery vehicle. Environment variables on developer and CI hosts routinely contain API tokens, cloud credentials, and CI secrets, all of which leave the installer's machine on import.

Compromised versions (1)

1.48.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.