MAL-2026-10611

Dashboard / Malicious Package / MAL-2026-10611

MAL-2026-10611

Summary: Malicious code in @web3-helpers/core (npm)

Details: Source: amazon-inspector (9d5230cf08adcdf1d9108129f5c80e569b74774b7f2cb5e55aeb60be8d737225) At npm install time the preinstall script (dist/index.min.js) reads installer-owned secrets — ~/.ssh/id_rsa, ~/.env, ~/.env.local, ~/.wallet.json — and iterates process.env for keys matching PRIVATE_*, MNEMONIC*, and SECRET*. Extracted content is scanned for 64-hex and WIF private keys and posted, along with the installer's hostname and username, to https://api.telegram.org/bot<redacted>/sendMessage using a hardcoded bot token. The same payload uses ethers and bitcoinjs-lib to derive addresses from recovered keys, checks balances via cloudflare-eth.com and blockchain.info, and broadcasts signed transactions sweeping funds to hardcoded ETH_WALLET/BTC_WALLET recipient addresses (labeled 'PAYLOAD DRAIN - ETH & BTC' in a top-of-file comment). A binding.gyp file additionally uses GYP command expansion (`<!(node -e "require('./dist/index.min.js')...")`) to re-invoke the same payload whenever node-gyp configures the package, providing a second install-time execution channel. The package name mimics legitimate Web3 helper libraries, package.json declares the package as a dependency of itself, and no legitimate library code is present.

References: https://www.npmjs.com/package/@web3-helpers/core/v/1.0.2, https://www.npmjs.com/package/@web3-helpers/core/v/1.0.1, https://www.npmjs.com/package/@web3-helpers/core/v/1.0.5, https://www.npmjs.com/package/@web3-helpers/core/v/1.0.3, https://www.npmjs.com/package/@web3-helpers/core/v/1.0.0, https://www.npmjs.com/package/@web3-helpers/core/v/1.0.4, https://www.npmjs.com/package/@web3-helpers/core/v/1.0.6