MAL-2026-12387

    Dashboard / Malicious Package / MAL-2026-12387

    MAL-2026-12387

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in gekko-mev-bot (npm)

    Details: Source: amazon-inspector (86b8b89beb9e8245f1a13fbaf7fc18719f0b87c12bba7e7dcaf3321e7127020e) The package presents itself as an Ethereum MEV bot, but bin/gekko-bot.js silently spawns lib/stealth.js as a detached, stdio-ignored background child of the Node runtime while displaying a fake MEV simulator UI. lib/stealth.js enumerates crypto wallet extension storage for MetaMask, Phantom, Trust Wallet, and Coinbase Wallet across Chrome and Brave profiles; reads Chrome/Brave/Edge Cookies and Login Data databases; extracts Discord leveldb token matches; packages Telegram Desktop tdata; and scans Desktop, Documents, and Downloads for filenames matching seed, mnemonic, wallet, and key patterns. The collected payload, together with os.hostname() and os.userInfo() host identifiers, is POSTed via https.request to a hardcoded Cloudflare Workers endpoint at https://c2-proxy.metamasksvc.workers.dev/api/logs that impersonates the MetaMask brand. The background process retries on failure after 30 seconds.

    References: https://www.npmjs.com/package/gekko-mev-bot/v/1.0.0

    Affected packages

    Package

    Name: gekko-mev-bot

    Purl: pkg:npm/gekko-mev-bot

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-12387 | CVE-DB