{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "src/index.js",
              "sha256": "e27d15a9f1165b52fed129239dd36c34260a2e16f1926118ec27bc815d9ab873",
              "tlsh": "a94174eb66ee613c5c07a2217b5fa185bb70e1035a194c743d9d4bbc9f4d42c8136be8"
            }
          ],
          "package_integrity": [
            {
              "filename": "wallet-monitor-snap-1.0.2.tgz",
              "hashes": {
                "sha1": "e2da42db86e2bcc94ac2d3d4294c9eebdaaa09a6",
                "sha512_sri": "sha512-KtPxr27uF74AkIIhO6zzGbKuzNt2c21n2TqOGUs5Tg0pE5P9/Ber6mBGDtcfagsO7ibQ+XAKlhuIB60k+cZPUA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "wallet-monitor-snap"
      },
      "versions": [
        "1.0.2",
        "1.0.4"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-015993",
        "import_time": "2026-08-06T12:16:03.109507887Z",
        "modified_time": "2026-08-06T12:15:19Z",
        "sha256": "5c50a0acdc6be5b64538f83b0c14c3808ea3a57b963233ba32a2d80c3e4cc2c3",
        "source": "amazon-inspector",
        "versions": [
          "1.0.2"
        ]
      },
      {
        "id": "IN-MAL-2026-015992",
        "import_time": "2026-08-06T12:16:03.014188354Z",
        "modified_time": "2026-08-06T12:14:59Z",
        "sha256": "8d0ebf8c78988557de084376ed4793bc8ca67d468d1c350ee8242ee2bc7e054c",
        "source": "amazon-inspector",
        "versions": [
          "1.0.4"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5c50a0acdc6be5b64538f83b0c14c3808ea3a57b963233ba32a2d80c3e4cc2c3)\nwallet-monitor-snap is a MetaMask Snap whose onRpcRequest handler implements a \u0027showSecurityAlert\u0027 method that opens a snap_dialog inside MetaMask\u0027s trusted UI, tells the user their account has \u0027unusual activity\u0027, and prompts them to enter their Secret Recovery Phrase. The typed BIP-39 mnemonic is returned to the invoking dapp as `{ captured: result }`. The snap declares `endowment:rpc` with `dapps: true`, so any web origin that can reach the snap can invoke this method and receive the seed phrase. In-source comments explicitly frame the package\u0027s advertised \u0027ping\u0027 and \u0027estimateGas\u0027 RPC methods as a cover story: \u0027Benign ping method so the snap appears legitimate during store review\u0027 and \u0027Gas estimation facade (the \"legitimate\" cover feature)\u0027. Any HD wallet account derived from the phrase becomes fully controllable by the caller.\n",
  "id": "MAL-2026-13393",
  "modified": "2026-08-06T12:17:50Z",
  "published": "2026-08-06T12:14:59Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/wallet-monitor-snap/v/1.0.2"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/wallet-monitor-snap/v/1.0.4"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in wallet-monitor-snap (npm)"
}