bip39-generator (npm) · Malicious Code
Affects bip39-generatorSource GCVE Database
Malicious package : remove bip39-generator and rotate any secrets on hosts that installed it.
Data as of 5 Aug 2026, 23:00 UTC
Malicious package
Published to npm · OSV MAL-2026-13257
What to do
Remove bip39-generator from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmbip39-generator | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The bip39-generator npm package version 3.1.2 is a malicious typosquatting package that exfiltrates environment variables and host information to an attacker's Telegram channel. It masquerades as a drop-in replacement for the legitimate bip39 package but exports non-functional wallet and mnemonic functions. On load, it collects sensitive environment data and sends it encoded via HTTPS GET requests to a hardcoded Telegram bot endpoint, potentially leaking API keys, cloud credentials, and CI secrets.