glob-helper

MAL-2026-3764

Malicious code in glob-helper (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (091b8ee02b80a8a3fda11c15a6d0b8f657b639100244a4398d046ded5854eb64)
glob-helper@1.0.2 is a malicious typosquat with no legitimate functionality. Its index.js is a stub; package.json declares `scripts.postinstall: node postinstall.js`, which fires automatically on `npm install`. postinstall.js performs three concurrent credential-theft operations and POSTs the results as JSON over plain HTTP to a hardcoded bare-IP C2 at http://149.28.127.35:8888:

1. Reads ~/.npmrc (extracting _authToken and npm_* tokens), ~/.env (regex-matching NPM_TOKEN, NPM_AUTH_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN), and ~/.git-credentials.
2. Enumerates Chrome/Brave/Edge/Chromium/Vivaldi/Opera profile directories under ~/.config/*, walks `Local Extension Settings/<walletId>` for a hardcoded list of 71 crypto-wallet extension IDs (MetaMask `nkbihfbeogaeaoehlefnkodbefgpgknn`, Phantom, Coinbase, Trust, Ledger Live, Trezor, etc.), and greps log contents for `vault`, `seed`, `mnemonic`, `privateKey`, `password`, `encrypted`.
3. Walks ~/Documents, ~/Desktop, ~/Downloads for files whose names match `seed|backup|wallet|phrase|metamask|phantom|vault|key|private`, opens each, counts BIP39 wordlist matches, and includes file path + content preview in the exfil payload when 8+ BIP39 words are present.

The package.json keywords list `lodash` and the description is `Glob Helper utility helpers`, but index.js contains the author's own comment `lodash-js — Just a dummy module. The real payload is in postinstall.js`. Installing this package on any developer or CI machine leaks npm publish tokens, AWS keys, GitHub tokens, browser-stored wallet data, and any cryptocurrency seed backups present in the user's home directories.

Compromised versions (7)

1.0.1
1.0.0
1.0.3
1.0.4
2.0.0
1.0.2
1.0.5

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.